Go
chainloop-dev/chainloop
SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more
Apache-2.0Jul 16, 2026 · metrics 2.10.0
All tags
Catalogue tag
#attestation
Every repository in the public record carrying this tag — from its GitHub topics or the keywords its package registries publish. Health is measured under the same versioned methodology as the rest of the record.
32 records
crates.io
confidential-containers/trustee
Attestation and Secret Delivery Components
Apache-2.0Aug 19, 2026 · metrics 2.10.0
Go
kubernetes-sigs/tejolote
A highly configurable build executor and observer designed to generate signed SLSA provenance attestations about build runs.
Apache-2.0Jul 24, 2026 · metrics 2.10.0
npm
actions/toolkit
The GitHub ToolKit for developing GitHub Actions.
MITAug 28, 2026 · metrics 2.10.0
PyPI · crates.io · Go +1
in-toto/attestation
in-toto Attestation Framework
Custom licenseAug 29, 2026 · metrics 2.10.0
PyPI
CycloneDX/cyclonedx-python-lib
Functionality and DataModels of OWASP CycloneDX for Python
Apache-2.0Jul 17, 2026 · metrics 2.10.0
Go
carabiner-dev/ampel
🔴🟡🟢 The Amazing Multipurpose Policy Engine (and L)
Apache-2.0Jul 21, 2026 · metrics 2.10.0
PyPI
agentrust-io/trace-spec
TRACE: Trust Runtime Attestation and Compliance Evidence. Open attestation standard for agentic AI governance.
Custom licenseSep 6, 2026 · metrics 2.10.0
PyPI
vaaraio/vaara
Accountable Autonomy: open-source evidence layer that gates every AI agent tool call against your policy and writes a hash-chained record an auditor verifies offline, without trusting you. Root-agnostic; binds to TPM 2.0 / SEV-SNP when present. Your environment, no SaaS, no telemetry. AGPL-3.0.
AGPL-3.0Aug 22, 2026 · metrics 2.10.0
crates.io · PyPI · npm +1
Phala-Network/dcap-qvl
No repository description published.
MITJul 23, 2026 · metrics 2.10.0
crates.io
tkhq/rust-sdk
Repository containing Rust tooling to interact with the Turnkey API
Apache-2.0Sep 5, 2026 · metrics 2.10.0
crates.io
Azure/corim
Rust Implementation of CoRIM (Concise Reference Integrity Manifest)
Custom licenseJul 31, 2026 · metrics 2.10.0
Go
liatrio/autogov
Unified CLI for software supply-chain governance / verify GitHub artifact attestations, evaluate OPA/Rego policies, generate SLSA Verification Summary Attestations (VSAs), and manage releases.
Apache-2.0Aug 1, 2026 · metrics 2.10.0
npm · PyPI
delimit-ai/delimit-mcp-server
The merge gate for AI-written code, with signed, replayable attestation. Works across Claude Code, Codex, Cursor, and Gemini CLI.
MITAug 3, 2026 · metrics 2.10.0
npm · Go · crates.io
automata-network/automata-dcap-attestation
This repo contains Web3 Implementation of Intel DCAP Quote Verification For Various Ecosystems
MITJul 18, 2026 · metrics 2.10.0
Go
carabiner-dev/bnd
Sign and package attestations in sigstore bundles
Apache-2.0Jul 23, 2026 · metrics 2.10.0
npm · crates.io · PyPI
evervault/attestation-doc-validation
A rust crate for validating attestation documents provided by Trusted Execution Environments. Current support is limited to AWS Nitro Enclaves.
Apache-2.0Aug 20, 2026 · metrics 2.10.0
PyPI
msaleme/red-team-blue-team-agent-fabric
540 security tests for AI agent systems — MCP, A2A, x402/L402, decision governance, benchmark integrity, skill supply chain. AIUC-1 pre-cert, NIST AI 800-2 aligned, MCP tool-poisoning reproduction. v4.9.1
Apache-2.0Jul 20, 2026 · metrics 2.10.0
PyPI
b7n0de/proofbundle
Offline cryptographic receipts for AI evaluation results — Ed25519 + RFC 6962 Merkle + optional SD-JWT. Integrity, not truth
MITJul 23, 2026 · metrics 2.10.0
crates.io
kinvolk/azure-cvm-tooling
Libraries and tools for Confidential Computing on Azure
MITJul 24, 2026 · metrics 2.10.0
Maven
a-sit-plus/signum
Kotlin Multiplatform Crypto/PKI/ASN.1 Library with Attestation and Hardware-Backed Crypto Support on Mobile
Apache-2.0Sep 2, 2026 · metrics 2.10.0
crates.io
auths-dev/auths
Local first, air-gapped identity for individuals, AI agents, organizations, with permissioning. Docs below are for contributors.
Custom licenseJul 29, 2026 · metrics 2.10.0
npm
dot-skill/skillerr
Open .skill Protocol - a sealed, inspectable package format for AI agent skills. Reference implementation: skillerr.
Apache-2.0Jul 27, 2026 · metrics 2.10.0
PyPI
agentrust-io/agent-manifest
Agent Manifest SDK. Hardware-anchors all 10 artifacts defining an agent at deployment. Python and TypeScript.
Custom licenseAug 2, 2026 · metrics 2.10.0
RubyGems
cedarcode/tpm-key_attestation
TPM 2.0 Key Attestation validation in ruby
Apache-2.0Jul 26, 2026 · metrics 2.10.0
PyPI
QWED-AI/qwed-ucp
Verification for Universal Commerce Protocol (UCP) transactions — Deterministic verification layer for UCP checkouts: catches math, state, and schema errors before payment.
Apache-2.0Jul 30, 2026 · metrics 2.10.0
Packagist
k2gl/dsse
Sign and verify DSSE (Dead Simple Signing Envelope) payloads in PHP.
MITJul 26, 2026 · metrics 2.10.0
npm · PyPI
orangecheck/oc-packages
Monorepo for the @orangecheck/* npm packages + the orangecheck Python SDK. SDK, gate middleware, React bindings, wallet adapter, CLI, Strfry relay filter, airdrop-gate.
MITJul 27, 2026 · metrics 2.10.0
npm · Go
daily-nerd/vitni
The verifiable trail of agent actions — signed, tamper-evident execution receipts for AI agents (MCP & A2A).
Apache-2.0Jul 17, 2026 · metrics 2.10.0
Go
Verdifax/verdifax-verify
Cryptographic attestation infrastructure for high-stakes AI decisions. Every governed execution produces a sealed, independently-verifiable manifest hash. USPTO patent + trademark filed.
MITJul 22, 2026 · metrics 2.10.0