Use the tools your agent already uses.

The cilock git attestor captures the repository state at the working directory — HEAD commit, identities, refs, remotes, tags, parents, tree hash, and dirtiness — signed into in-toto evidence.

Snapshots GitHub PR review state for the current commit (or an explicit SHA/PR) via the GitHub REST API (token: GH_TOKEN/GITHUB_TOKEN, or `gh auth token` fallback).

The cilock github attestor fetches the GitHub Actions OIDC token, verifies it against the GitHub JWKS, and signs the decoded claims plus workflow context into in-toto evidence.

The cilock gitlab attestor captures GitLab CI job context plus the GitLab-issued OIDC JWT and signs it into in-toto evidence, proving an attestation came from a specific pipeline, job, and project.

The cilock aws-codebuild attestor captures CodeBuild build identity from CODEBUILD_* env vars and the BatchGetBuilds API, signing the full build context into in-toto evidence.

go test — Go test runner.

pytest — Python test runner.

Jest — JavaScript test runner (Meta).

go build — Go compiler. Output binaries carry BuildInfo (module + VCS metadata) which the go-build attestor extracts and writes as a JSON sidecar so the evidence survives strip(1).

The cilock docker attestor parses docker buildx --metadata-file JSON from products and records image digests, references, and per-architecture SLSA materials into signed in-toto evidence.

The cilock slsa attestor assembles a SLSA Provenance v1.0 predicate from sibling attestors in the same collection and signs it into in-toto evidence under the slsa.dev predicate type.

Sigstore cosign — container/artifact signing (validated via cosign sign-blob with a local ED25519 key).

Generate signed CycloneDX or SPDX SBOMs with cilock — Anchore's Syft runs under `cilock run` so the SBOM is captured as a real v0.3 product, hashed into a Merkle tree, and parsed by the `sbom` attestor.

The cilock sbom attestor picks up SPDX-JSON or CycloneDX-JSON files from the product set, stores each document byte-preservingly, and signs it into in-toto evidence under the SBOM's native predicate type.

Scan containers, IaC, secrets, and licenses with Trivy under cilock — the SARIF report becomes a signed v0.3 attestation parsed by the rookery sarif attestor.

Scan lockfiles or containers against the OpenSSF OSV vulnerability database with OSV-Scanner under cilock — each match becomes a signed v0.3 SARIF attestation.

Run Semgrep SAST under cilock — the SARIF report becomes a signed v0.3 attestation parsed by the rookery sarif attestor; supports any of Semgrep's bundled rulesets or custom rules.

The cilock sarif attestor captures a SARIF result file emitted by a code scanner (CodeQL, Semgrep, gosec, Trivy) and embeds it byte-identical in a signed in-toto attestation under a .report field.

Conftest — Rego/OPA policy testing for structured config.

The cilock policyverify attestor emits a SLSA Verification Summary Attestation recording the outcome of a cilock verify run against a signed policy, signed into in-toto evidence.

Observe which coding-agent process appears in cilock's ancestry, with bounded version, model, sandbox, configuration, and environment context that is explicitly non-enforcing.

apko — builds single-layer OCI images from apk packages (Chainguard); auto-generates an SPDX SBOM per build.

Argo Workflows — Kubernetes-native workflow engine (CNCF).

Captures AWS Security Finding Format (ASFF) reports from AWS Security Hub (typically the output of `aws securityhub get-findings`).

The cilock aws attestor fetches the EC2 instance identity document from IMDS, verifies its RSA-SHA256 signature against the AWS region certificate, and signs the verified host identity into in-toto evidence.

Captures AWS Config compliance state for resources (output of `aws configservice get-compliance-details-by-config-rule` and related calls).

AWS GuardDuty — threat detection findings (CloudTrail/VPC/DNS log analysis).

AWS IAM credential report — per-user MFA + key-rotation + password-age posture.

AWS Inspector v2 — vulnerability + network reachability findings for EC2/ECR/Lambda.

AWS Macie — automated S3 sensitive-data discovery.

AWS Secrets Manager via aws-cli.

AWS Security Hub — central security findings aggregator across AWS services.

Azure Activity Log / Monitor logs.

Azure DevOps Pipelines — Microsoft CI/CD context.

Azure VM IMDS — instance metadata + attested identity document.

Bandit — Python static security analyzer (PyCQA).

Record where the tested commit sits relative to its base branch — head, the base the clone saw, their merge-base, and whether the head includes that base — so a gate can enforce "current with base" against the provider's live base.

Bitbucket Pipelines — Atlassian CI/CD context.

Kubernetes SIGs `bom` — SBOM tool for Kubernetes releases (SPDX).

Buildkite CI/CD context.

The cilock buildpacks attestor parses the CNB lifecycle's report.toml and the io.buildpacks.* label dump, binding a pack build's image digest, run image, buildpack group, and SBOM-layer digest into signed in-toto evidence.

cargo-audit — Rust dependency vulnerability scanner.

cargo build — Rust build orchestrator.

CycloneDX SBOM generator (cdxgen) — multi-language SBOM tool from OWASP.

Scan Terraform, CloudFormation, Kubernetes, Helm, and other IaC with Checkov under cilock — every misconfig becomes a signed v0.3 SARIF attestation.

CircleCI CI/CD context.

Google Cloud Build — GCP managed CI.

AWS CloudTrail — AWS account audit log.

AWS CodeBuild context.

Run GitHub CodeQL under cilock — the SARIF report from `codeql database analyze` becomes a signed v0.3 attestation parsed by the rookery sarif attestor, with the literal codeql argv captured in command-run/v0.2.

The cilock command-run attestor records the executed argv, exit code, captured stdout/stderr, and an optional Linux ptrace forensic record, signed into in-toto evidence.

(no detector.yaml; user-driven or always-on)

The cilock configuration attestor captures the raw CLI flags and working directory that drove a run, signing them into in-toto evidence.

Sigstore cosign verification.

detect-secrets — Yelp's pre-commit secret scanner.

Captures Docker Bench for Security CIS benchmark results.

Drone — open-source container-native CI.

The cilock environment attestor captures the host OS, hostname, username, and full process environment with sensitive values obfuscated, signing them into in-toto evidence.

Captures runtime security events from Falco (Cloud Native Computing Foundation runtime threat detection).

Google Cloud Audit Logs (Cloud Logging).

The cilock gcp-iit attestor captures the GCE Instance Identity Token, verifies its signature against Google's JWKS, and signs the resulting GCE host identity into in-toto evidence.

The cilock github-action attestor captures GitHub Action execution metadata — reference, type, inputs/outputs, exit code, and runtime context — signed into in-toto evidence.

The cilock githubwebhook attestor verifies a GitHub webhook payload's HMAC-SHA256 signature and signs the parsed payload and event name into in-toto evidence.

Gitleaks — secret detection in git history and source.

Run gosec Go SAST under cilock — flags insecure patterns (weak crypto, math/rand, command injection) and emits a signed v0.3 SARIF attestation linked to the commit that produced the code.

Scan Go modules for vulnerabilities with reachability via govulncheck under cilock — the SARIF report becomes a signed v0.3 attestation parsed by the rookery sarif attestor.

GnuPG signing — long-form artifact signature.

Gradle — JVM build tool (Java/Kotlin/Groovy/Android).

Scan images or directories for vulnerabilities with Grype under cilock — the SARIF report becomes a signed v0.3 attestation parsed by the rookery sarif attestor, byte-identical to what Grype produced.

Lint Dockerfiles with Hadolint under cilock — pinned base images, package install hygiene, USER root checks, and 100+ other rules become a signed v0.3 SARIF attestation.

helm install / upgrade — Kubernetes chart deployment.

HuggingFace Hub CLI (`hf`) — model card + repo management. Validated by generating a HuggingFace-standard ModelCard README.md and attesting it as a material.

The cilock inclusion-proof attestor binds a single file's digest to a Merkle tree root via an RFC 6962 audit path and signs it into in-toto evidence for downstream per-file verification.

Run Chef InSpec (Progress) compliance profiles under cilock — every CIS, custom Ruby, or dev-sec.io scan becomes a signed v0.1 InSpec attestation linked to the profile and target it scanned.

The cilock instruction-file attestor signs the digests of agent instruction files (CLAUDE.md, AGENTS.md, SKILLS.md, .cursorrules) and records whether the signing credential belongs to a workload or to a human's interactive session.

The cilock jenkins attestor captures Jenkins build metadata from JENKINS_/BUILD_ environment variables and signs it into in-toto evidence, binding an artifact to the pipeline run that produced it.

The cilock jwt attestor parses a JWT, fetches a JWKS, verifies the token signature, and signs the decoded claims plus the verifying key into in-toto evidence as a generic OIDC identity proof.

The cilock k8smanifest attestor walks YAML/JSON Kubernetes manifests, strips ephemeral fields, records per-document digests and container image references, and signs them into in-toto evidence.

KICS — Checkmarx IaC security scanner.

The cilock kube-bench attestor ingests an Aqua Security kube-bench CIS Kubernetes Benchmark JSON report from the step's products and signs a per-check pass/fail/warn summary into in-toto evidence.

kubeaudit — K8s security auditor (Shopify).

kubectl get audit/events — Kubernetes API audit access.

Scan Kubernetes manifests or a live cluster snapshot for NSA/CISA, MITRE, and ArmoBest framework violations with Kubescape under cilock — emits a signed v0.3 SARIF attestation.

kustomize build — declarative K8s manifest customization.

Kyverno — Kubernetes policy management (CNCF).

The cilock link attestor synthesizes an in-toto Link v0.3 predicate from the step's command-run, material, product, and environment attestors and signs it into in-toto evidence for legacy verifiers.

Capture Linkerd service-mesh state under cilock — the native linkerd-check attestor parses `linkerd check -o json` plus optional `linkerd viz edges -o json` into a signed v0.3 attestation with per-category check rollup and per-edge mTLS booleans, gated by Rego for release-time mTLS enforcement.

The cilock lockfiles attestor captures the contents and SHA-256 digest of common package-manager lockfiles in the working tree and signs them into in-toto evidence as a pinned-dependency fingerprint.

malcontent (`mal`) — flags supply-chain-attack capabilities and behaviors in binaries and source (Chainguard).

The cilock material attestor snapshots the working directory before a step runs and emits a single RFC 6962 Merkle-root in-toto subject (tree:materials) over every input file's digest.

The legacy v0.1 material wire format — a flat path→digest map of every input file. Verify-only today; current builds emit material v0.3. Documented for reading pre-cutover attestations.

The cilock maven attestor parses a Maven pom.xml and signs the project coordinates and declared dependencies into in-toto evidence as a static, pre-build dependency record.

Apache Maven `mvn` — JVM dependency + build orchestrator (catalog-only; the maven attestor plugin emits the actual SLSA-style record).

melange — builds apk packages from declarative YAML pipelines (Chainguard); emits an SBOM per package.

Nancy — Sonatype's OSS Index vulnerability scanner for Go modules.

notation (Notary v2) — OCI artifact signing.

npm audit — Node.js dependency vulnerability scanner.

npm install / npm ci — Node.js dependency resolution + install.

Run ProjectDiscovery Nuclei under cilock — the SARIF report it emits via -sarif-export becomes a signed v0.3 attestation parsed by the rookery sarif attestor; supports any of Nuclei's ~13,000 community templates.

The cilock oci attestor ingests an OCI/Docker image saved as a tarball product and signs the manifest, image ID, layer diffIDs, and repo tags into in-toto evidence.

The cilock omnitrail attestor captures a content-addressed trail of every file and directory under the working directory with POSIX metadata, signed into in-toto evidence for cross-tool provenance correlation.

Run OpenSCAP (oscap) XCCDF baseline scans under cilock — every SCAP Security Guide profile evaluation becomes a signed in-toto envelope carrying parsed pass/fail/N/A counts plus the raw XCCDF results XML.

pip-audit — Python dependency vulnerability scanner from PyPA.

The cilock pip-install attestor captures the post-build Python package environment via pip, statically analyzes installed code and PyPI PEP 740 provenance, and signs it into in-toto evidence.

(no detector.yaml; user-driven or always-on)

pnpm install — fast disk-efficient Node.js package manager.

Polaris — Fairwinds Kubernetes best-practices validator.

The cilock product attestor snapshots the working directory after a step runs and emits a single RFC 6962 Merkle-root in-toto subject (tree:products) over every output file's digest.

The legacy v0.1 product wire format — a flat path→Product map with per-file MIME and digest, one file subject each. Verify-only today; current builds emit product v0.3.

The legacy v0.2 product wire format — same per-file map as v0.1 but a single tree:products subject via a hand-rolled hash chain. Verify-only today; current builds emit product v0.3.

Protocol Buffers compiler — generates Go/Java/Python/JS bindings from .proto files. Common in monorepos with API codegen pipelines.

Scan AWS, GCP, Azure, Kubernetes, and Microsoft 365 against CIS, NIST, ISO 27001, HIPAA, and PCI-DSS with Prowler under cilock — findings become a signed v0.3 attestation parsed by the native prowler attestor.

RetireJS — JavaScript library vulnerability scanner.

Safety — Python dependency vulnerability scanner (PyUp).

Capture a Google Workspace tenant's raw configuration with CISA ScubaGoggles under cilock — the provider settings become a signed scubagoggles/v0.1 attestation that your own Rego policy evaluates. Facts in the evidence, verdict in the policy.

The cilock secretscan attestor runs a Gitleaks pattern scan over every product and prior attestor's JSON, with recursive decoding, recording redacted findings into signed in-toto evidence.

(no detector.yaml; user-driven or always-on)

staticcheck — Go static analyzer (Honnef.co/go/tools).

Query AWS, GCP, Azure, Kubernetes, GitHub, and other cloud or SaaS APIs as SQL with Steampipe under cilock — every row becomes a signed v0.1 Steampipe attestation chained to subject digests per identity axis.

The cilock system-packages attestor records the build host's installed OS package inventory (name and version) before materials are gathered, signing it into in-toto evidence.

JetBrains TeamCity CI/CD context.

Tekton Pipelines — Kubernetes-native CI/CD (CDF).

Terrascan — multi-IaC scanner (Terraform/K8s/Helm/ARM).

Captures JUnit XML test reports and CTRF JSON reports produced by test runners (Go: gotestsum --junitfile junit.xml -- ./... or go-junit-report — plain go test has no JUnit flag; pytest --junitxml, jest-junit, gradle, surefire, etc.).

Run testssl.sh TLS connection scans under cilock — the testssl JSON output becomes a signed v0.3 attestation parsed by the rookery sarif attestor, capturing protocol negotiation, cipher matrix, named TLS vulnerabilities, and FIPS 140-2/140-3 compliance findings.

TFLint — Terraform linter for syntax + provider correctness.

tfsec — Terraform-specific static analysis (Aqua Security).

Travis CI context.

TruffleHog — secret + credential scanner (Truffle Security).

HashiCorp Vault CLI — secret distribution / dynamic credentials.

The cilock vex attestor captures an OpenVEX document found among a step's product files and attaches it as in-toto evidence under the canonical OpenVEX predicate type URI.

vexctl — OpenVEX statement generation.

yarn audit — Yarn dependency vulnerability scanner.

yarn install — Yarn package manager install.

Run OWASP ZAP DAST scans under cilock — the SARIF report from ZAP's automation framework becomes a signed v0.3 attestation parsed by the rookery sarif attestor, with the literal docker argv captured in command-run/v0.2.

Run Zarf under cilock so `zarf package create` — the air-gap package build — is captured as a signed run where the package tarball becomes a real v0.3 product and the literal zarf argv is recorded in command-run/v0.2.