Source and verification status
Published runtime hardening is available in Python attestix 0.4.2 on PyPI. This source also prepares the 0.4.3 website/documentation update; source metadata is not proof of registry publication. The JavaScript offline verifier is also published as npm attestix 0.4.2. Main may contain later changes; compare release notes and pin the version you reviewed. Go and Java 0.4.2 are published. R and Rust have GitHub 0.4.2 releases, while CRAN and crates.io still serve 0.4.1 at this release cutoff.
- Credential verification binds the stated issuer to the supported proof controller. Ambiguous NFC-normalized keys fail before signing or verification.
- Presentation verification requires the caller's expected challenge and domain. A signature alone does not provide replay protection.
- REST use requires an API key by default. The default REST server is single-tenant and rejects non-default tenant headers; a shared API key does not provide cross-tenant authorization.
- JSON updates use the shared storage lock. Protect the local signing key and data directory; test backup restoration, isolation and your selected signer/backend before production.
workflow_completedescribes recorded documentation completion.legal_conformityis not assessed; the deprecatedcompliantfield is a workflow alias. Generated declarations are drafts for provider review.- Local purge cannot erase external replicas, remote logs, previously shared credentials or third-party backups. Plan historical data and credential migration separately.
Install
# Reviewed release (check release notes before upgrading):
pip install attestix==0.4.2
Since 0.4.0, the supported namespace is the canonical
attestix.*namespace. The older flat layout (from services... import,from auth... import, ...) keeps working via thin deprecation shims that emit aDeprecationWarningon first import and are scheduled for removal in v0.5.0. Update imports tofrom attestix.services... importat your earliest convenience.
CLI
attestix status # System overview
attestix init --name MyBot # Create agent identity
attestix compliance <agent-id> # Check recorded documentation gaps
attestix verify <agent-id> # Verify identity cryptographically
attestix audit <agent-id> # View hash-chained audit trail
attestix credential --list # List W3C Verifiable Credentials
REST API
pip install 'attestix[api]'
# Configure ATTESTIX_API_KEY in your environment before starting the API.
uvicorn attestix.api.main:app --reload # Swagger docs at http://localhost:8000/docs
Web Dashboard
pip install streamlit
streamlit run demo/webapp/app.py # Opens at http://localhost:8501
Quick Demo
python examples/quickstart.py # Local synthetic workflow
Verify in any language
Attestix credentials use a published canonical-JSON and Ed25519 verification profile. Language-specific verifier repositories share conformance fixtures, but their trust-input and delegation-chain checks differ. Read each verifier README and pin a reviewed version. Cryptographic validity is separate from issuer trust, authorization, revocation and replay policy.
Every verifier targets the Attestix canonical-JSON profile, which differs from strict RFC 8785,
and Ed25519 signatures (RFC 8032) against
the shared spec/verify/v1
vectors. Verify in the browser at https://attestix.io/verify, or read the
bundle wire-format at https://attestix.io/spec/bundle/v1.
Why Attestix
The EU AI Act has a staged application timeline. The European Commission currently lists 2 December 2027 for specified high-risk use cases and 2 August 2028 for high-risk systems embedded in regulated products. Applicability depends on the system and the operator's role. See the European Commission's current AI Act guidance.
Attestix helps organize evidence; a signature or generated declaration does not establish legal conformity or replace the applicable assessment process.
Attestix provides agent identity, signed credentials, delegation, and offline verification for developers who need portable evidence in their applications. Broader governance platforms also offer APIs, SDKs, agent governance, and compliance workflows; evaluate their current capabilities against your requirements.
Agent identity is fragmenting across walled gardens (Microsoft Entra, AWS AgentCore, ERC-8004). Attestix combines agent identity, AI governance evidence and verifiable credentials in one toolkit.
Attestix fills this gap.
Modules
Quick Start
As an MCP Server (Claude Code)
Add to your Claude Code config (~/.claude.json):
{
"mcpServers": {
"attestix": {
"type": "stdio",
"command": "python",
"args": ["-m", "attestix.main"]
}
}
}
Then ask Claude:
"Create an identity for my data analysis agent with capabilities: data_analysis, reporting"
As a Python Library
from attestix.services.identity_service import IdentityService
from attestix.services.compliance_service import ComplianceService
from attestix.services.credential_service import CredentialService
identity_svc = IdentityService()
compliance_svc = ComplianceService()
credential_svc = CredentialService()
# 1. Create an agent identity
agent = identity_svc.create_identity(
display_name="MyAgent",
source_protocol="manual",
capabilities=["data_analysis", "reporting"],
description="Analyzes quarterly financial data",
issuer_name="VibeTensor",
expiry_days=365,
)
agent_id = agent["agent_id"] # attestix:f9bdb7a94ccb40f1
agent_did = agent["issuer"]["did"] # did:key:z6Mk...
# 2. Create a compliance profile
profile = compliance_svc.create_compliance_profile(
agent_id=agent_id,
risk_category="limited",
provider_name="VibeTensor",
intended_purpose="Analyzes quarterly financial data",
)
# 3. Issue a verifiable credential
credential = credential_svc.issue_credential(
subject_id=agent_id,
credential_type="AgentIdentityCredential",
issuer_name="VibeTensor",
claims={"capabilities": ["data_analysis", "reporting"]},
expiry_days=365,
)
print(credential["proof"]["type"]) # Ed25519Signature2020
For a complete end-to-end walkthrough covering all 9 modules, run the quickstart:
python examples/quickstart.py
From Source
git clone https://github.com/VibeTensor/attestix.git
cd attestix
pip install -r requirements.txt
python -m attestix.main
AI governance evidence workflow
Record a high-risk AI agent documentation workflow for provider review:
1. create_agent_identity --> UAIT with DID (Ed25519 signed)
2. record_training_data --> Article 10 data governance
3. record_model_lineage --> Article 11 technical documentation
4. create_compliance_profile --> Risk categorization + obligations
5. record_conformity_assessment --> Operator-recorded assessment details
6. generate_declaration_of_conformity --> Annex V declaration + W3C VC
7. create_verifiable_presentation --> Signed VP for a verifier with a fresh challenge
The current Attestix workflow blocks self-assessment for a profile marked high-risk. This application policy is not a universal determination of the legally applicable assessment route:
record_conformity_assessment(assessment_type="self", ...)
--> ERROR: "High-risk AI systems require third_party conformity assessment"
Full walkthrough: EU AI Act Compliance Guide
How It Works
Credentials and presentations carry signatures; audit chains carry integrity hashes. Not every record or external artifact is independently signed:
Local operation. Core identity and credential operations can use local JSON storage. Remote DID resolution, hosted signers and blockchain integrations require their configured services.
Architecture
attestix/ # Canonical Python package (v0.4.0)
main.py # MCP server entry point (MCP tools)
cli.py # `attestix` console script
config.py # Environment-based configuration
errors.py # Error handling with JSON logging
api/ # FastAPI REST surface
main.py # uvicorn entry: `attestix.api.main:app`
routers/ # REST routers
auth/
crypto.py # Ed25519 key management
ssrf.py # SSRF protection for outbound HTTP
services/
identity_service.py # UAIT lifecycle, local data erasure
agent_card_service.py # A2A agent card operations
did_service.py # DID creation and resolution
delegation_service.py # UCAN delegation tokens
reputation_service.py # Trust scoring
compliance_service.py # Operator-recorded profiles and assessment evidence
credential_service.py # W3C VCs and VPs
provenance_service.py # Training data, lineage, audit trail
blockchain_service.py # Base L2 anchoring via EAS
storage/ # Repository seam (file / memory / pg)
signing/ # Signer seam (in-process / kms)
audit/ # Tamper-evident event chain
tenancy/ # Tenant context
idempotency/ # Stripe-style idempotency keys + middleware
blockchain/
merkle.py # Merkle tree for batch anchoring
tools/ # MCP tool definitions (one file per module)
The pre-v0.4.0 flat layout (services/, auth/, storage/, ...) is
preserved as deprecation shims at the same paths. They re-export from the
canonical attestix.* namespace and emit a DeprecationWarning on first
import. The shims are scheduled for removal in v0.5.0.
MCP tools
Standards Conformance
Public tests and conformance fixtures cover selected signature, canonicalization, credential, delegation and interface behavior. They do not establish universal W3C interoperability, legal conformity, certification or operating acceptance. Consult the test cases and the selected verifier's documented boundaries. Run them yourself:
docker build -f Dockerfile.test -t attestix-bench . && docker run --rm attestix-bench
Performance
Benchmark results depend on interpreter, hardware, storage and workload. Run the repository benchmarks on your target environment; no static latency figure here is an operating guarantee.
Security
- Ed25519 signatures on all UAITs, VCs, assessments, declarations, and audit entries
- Hash-chained audit trail with SHA-256 for tamper-evident logging
- SSRF protection blocks private IPs, metadata endpoints, and DNS rebinding
- Encrypted key storage with AES-256-GCM when
ATTESTIX_KEY_PASSWORDis set - Private keys never exposed in tool responses
- No external API calls required for core operations
Research Paper
Attestix is described in a research paper covering system architecture, cryptographic pipeline, governance evidence workflows, and evaluation with 531 automated tests (440 functional + 91 RFC / W3C conformance benchmarks).
Attestix: A Unified Attestation Infrastructure for Autonomous AI Agents Pavan Kumar Dubasi, VibeTensor Private Limited, 2026.
Citing Attestix
If you use Attestix in your research, please cite:
@article{dubasi2026attestix,
title = {Attestix: A Unified Attestation Infrastructure for Autonomous AI Agents},
author = {Dubasi, Pavan Kumar},
year = {2026},
url = {https://github.com/VibeTensor/attestix},
note = {Open-source. Apache License 2.0}
}
Documentation
Full documentation at attestix.io/docs
Disclaimer
Attestix generates machine-readable, cryptographically signed compliance documentation. It is a documentation and evidence tooling system. It does not replace legal counsel, notified body assessments, or official regulatory submissions. Always consult qualified legal professionals for compliance decisions.
Sponsors
Attestix is free and open-source. If you or your organization benefit from it, please consider sponsoring to support continued development, security audits, and infrastructure.
Contributing
See CONTRIBUTING.md for development setup and guidelines.
License
Apache License 2.0. See LICENSE.
