attestix

Attestix

Compliance Automation for AI Agents

Make your AI agents EU AI Act compliant with cryptographically verifiable proof. Open-source identity, credentials, compliance automation, and trust scoring. 47 MCP tools across 9 modules, 44 REST API endpoints, 531-test suite (440 functional + 91 RFC / W3C conformance benchmarks). Real integrations with LangChain, OpenAI Agents SDK, and CrewAI.

Status: v0.4.0 stable (pre-release 0.4.1rc1 available via the --pre channel). Single-maintainer project, community contributions welcome. No independent third-party security audit has been performed yet; deploy with the same diligence you would apply to any pre-1.0 open-source crypto stack.

---

Install

# Stable 0.4.0:
pip install attestix

# Pre-release 0.4.1rc1 (opt in with --pre):
pip install --pre attestix

Stable 0.4.0 ships only the canonical attestix.* namespace. The older flat layout (from services... import, from auth... import, ...) keeps working via thin deprecation shims that emit a DeprecationWarning on first import and are scheduled for removal in v0.5.0. Update imports to from attestix.services... import at your earliest convenience.

CLI

attestix status                          # System overview
attestix init --name MyBot               # Create agent identity
attestix compliance            # Check EU AI Act compliance
attestix verify                # Verify identity cryptographically
attestix audit                 # View hash-chained audit trail
attestix credential --list               # List W3C Verifiable Credentials

REST API

pip install fastapi uvicorn
uvicorn attestix.api.main:app --reload   # Swagger docs at http://localhost:8000/docs

Web Dashboard

pip install streamlit
streamlit run demo/webapp/app.py         # Opens at http://localhost:8501

Quick Demo

python examples/quickstart.py            # Full 9-module workflow in 0.1 seconds

Verify in any language

Attestix credentials are issued once (Python core or cloud) and verify anywhere. Six independent verifier implementations share one conformance suite (spec/verify/v1): verify offline, no Python runtime, zero trust in the issuer. The verifiers are verifier-only: issuance stays in the Python core.

Language	Install	Status
Python	pip install attestix	live (full lib: issue + verify)
JS / TS	npm install attestix	live (attestix-js)
Go	go get github.com/VibeTensor/attestix-go	live (attestix-go)
Rust	cargo add attestix	live (attestix-rs)
Java	com.vibetensor:attestix:0.4.0	publishing soon (attestix-java)
R	install.packages("attestix")	coming to CRAN (attestix-r)

Every verifier checks the same canonical-JSON form (RFC 8785) and Ed25519 signatures (RFC 8032) against the shared spec/verify/v1 vectors. Verify in the browser at https://attestix.io/verify, or read the bundle wire-format at https://attestix.io/spec/bundle/v1.

Why Attestix

On August 2, 2026, the EU AI Act enforcement begins. Fines reach EUR 35M or 7% of global revenue.

Existing compliance tools (Credo AI, Holistic AI, Vanta) are organizational dashboards. None produce machine-readable, cryptographically verifiable proof that an AI agent can present to another agent, regulator, or system.

Agent identity is fragmenting across walled gardens (Microsoft Entra, AWS AgentCore, Google A2A, ERC-8004). No single tool combines agent identity + EU AI Act compliance + verifiable credentials in one protocol.

Attestix fills this gap.

---

Modules

Module	Tools	What it does
Identity	8	Unified Agent Identity Tokens (UAITs) bridging MCP OAuth, A2A, DIDs, and API keys. GDPR Article 17 erasure
Agent Cards	3	Parse, generate, and discover A2A-compatible agent cards
DID	3	Create and resolve W3C Decentralized Identifiers (did:key, did:web)
Delegation	4	UCAN-style capability delegation with EdDSA-signed JWT tokens
Reputation	3	Recency-weighted trust scoring (0.0 - 1.0) with category breakdown
Compliance	7	EU AI Act risk profiles, conformity assessments (Article 43), Annex V declarations
Credentials	8	W3C Verifiable Credentials with Ed25519Signature2020 proofs, presentations
Provenance	5	Training data provenance (Article 10), model lineage (Article 11), hash-chained audit trail (Article 12)
Blockchain	6	Anchor artifact hashes to Base L2 via Ethereum Attestation Service, Merkle batching

---

Quick Start

As an MCP Server (Claude Code)

Add to your Claude Code config (~/.claude.json):

{
  "mcpServers": {
    "attestix": {
      "type": "stdio",
      "command": "python",
      "args": ["-m", "attestix.main"]
    }
  }
}

Then ask Claude:

"Create an identity for my data analysis agent with capabilities: data_analysis, reporting"

As a Python Library

from attestix.services.identity_service import IdentityService
from attestix.services.compliance_service import ComplianceService
from attestix.services.credential_service import CredentialService

identity_svc = IdentityService()
compliance_svc = ComplianceService()
credential_svc = CredentialService()

# 1. Create an agent identity
agent = identity_svc.create_identity(
    display_name="MyAgent",
    source_protocol="manual",
    capabilities=["data_