Your team scans the code. ML-DSA-65 signs the proof. The registry makes it independently verifiable. Three parties. Zero trust required.
No single party controls the proof. The architecture makes collusion structurally difficult.
Runs the scan. Holds the private key. Signs the attestation record with ML-DSA-65 (FIPS 204, quantum-safe). The signature proves the scan results came from your key and have not been modified.
Clicks the verify link or fetches the API. Sees scan results, cryptographic proof, and evidence hashes. Can independently confirm the signature without trusting the provider or the registry.
Stores the signed attestation. Serves the verification page and SVG badge. Cannot forge signatures (does not hold your private key). Provides availability, not authority.
From scan to publicly verifiable proof in four steps.
The CLI hashes your codebase (SHA-256) and runs compliance checks across all selected frameworks (EU AI Act, ISO 42001, NIST AI RMF, Colorado SB 24-205).
Results are assembled into a structured record: system hash, check counts,
framework list, scanner version, evidence bundle hash, and timestamps.
Schema version 1.0.
The record is serialized to canonical bytes and signed with your ML-DSA-65 private key. The signature, algorithm, and public key fingerprint are embedded in the record.
With --publish, the signed record is POSTed to the public registry.
The registry validates the schema, checks for duplicates, and returns a
verification URL and embeddable badge.
What the registry stores. No source code. No secrets. Only proof.
Three endpoints. All public. No authentication required for reads.
Publish a signed attestation record. The registry validates the schema, verifies check count math, requires a cryptographic signature, and rejects duplicates. Max body size: 100KB. Records expire after 2 years.
Retrieve a raw attestation record as JSON. Returns the full record including cryptographic proof for programmatic verification.
Human-readable verification page. Shows scan summary, system info, cryptographic proof details, and an embeddable badge with copy-to-clipboard markdown.
SVG badge for embedding in READMEs, websites, and CI/CD dashboards. Green for all checks passed, yellow for warnings, blue for multi-framework attestations. Cached for 5 minutes.
Show compliance status anywhere. One line of markdown.
Install the scanner. Generate keys. Scan and publish.