Use the tools your agent already uses.

Admit a pod only when Judge passed its image. Kyverno asks the platform for each image digest, or checks the VSA attached to the image when the cluster has no platform access. In platform Enforce, an image needs an attached VSA only when the platform cannot answer for it or it is referenced by tag.

Admit a pod only when Judge passed its image, through an in-cluster Gatekeeper external data provider that holds the read-only credential and a bounded last-known-good cache.

The cilock git attestor captures the repository state at the working directory — HEAD commit, identities, refs, remotes, tags, parents, tree hash, and dirtiness — signed into in-toto evidence.

The cilock github-review attestor snapshots the pull request review state of a commit from the GitHub REST API (every PR that contains the commit and every review on it) and signs it as in-toto evidence.

The cilock github attestor fetches the GitHub Actions OIDC token, verifies it against the GitHub JWKS, and signs the decoded claims plus workflow context into in-toto evidence.

The cilock gitlab attestor captures GitLab CI job context plus the GitLab-issued OIDC JWT and signs it into in-toto evidence, proving an attestation came from a specific pipeline, job, and project.

The cilock aws-codebuild attestor captures CodeBuild build identity from CODEBUILD_* env vars and the BatchGetBuilds API, signing the full build context into in-toto evidence.

go test — Go test runner.

pytest — Python test runner.

Jest — JavaScript test runner (Meta).

The cilock go-build attestor reads the build information Go embeds in each compiled binary (module graph, VCS revision, build settings) from the step's products and writes a .gobuild.json sidecar that survives strip.

The cilock docker attestor parses docker buildx --metadata-file JSON from products and records image digests, references, and per-architecture SLSA materials into signed in-toto evidence.

The cilock slsa attestor assembles a SLSA Provenance v1.0 predicate from sibling attestors in the same collection and signs it into in-toto evidence under the slsa.dev predicate type.

Sigstore cosign — container/artifact signing (validated via cosign sign-blob with a local ED25519 key).

Generate signed CycloneDX or SPDX SBOMs with cilock — Anchore's Syft runs under `cilock run` so the SBOM is captured as a real v0.3 product, hashed into a Merkle tree, and parsed by the `sbom` attestor.

The cilock sbom attestor picks up SPDX-JSON or CycloneDX-JSON files from the product set, stores each document with one added format field, and signs it into in-toto evidence under the SBOM's native predicate type.

Scan containers, IaC, secrets, and licenses with Trivy under cilock — the SARIF report becomes a signed v0.3 attestation parsed by the rookery sarif attestor.

Scan lockfiles or containers against the OpenSSF OSV vulnerability database with OSV-Scanner under cilock — each match becomes a signed v0.3 SARIF attestation.

Run Semgrep SAST under cilock — the SARIF report becomes a signed v0.3 attestation parsed by the rookery sarif attestor; supports any of Semgrep's bundled rulesets or custom rules.

The cilock sarif attestor captures a SARIF result file emitted by a code scanner (CodeQL, Semgrep, gosec, Trivy) and embeds it byte-identical in a signed in-toto attestation under a .report field.

Conftest — Rego/OPA policy testing for structured config.

The cilock policyverify attestor emits a SLSA Verification Summary Attestation recording the outcome of a cilock verify run against a signed policy, signed into in-toto evidence.

Observe which coding-agent process appears in cilock's ancestry, with bounded version, model, sandbox, configuration, and environment context that is explicitly non-enforcing.

apko — builds single-layer OCI images from apk packages (Chainguard); auto-generates an SPDX SBOM per build.

Argo Workflows — Kubernetes-native workflow engine (CNCF).

Captures AWS Security Finding Format (ASFF) reports from AWS Security Hub (typically the output of `aws securityhub get-findings`).

The cilock aws attestor fetches the EC2 instance identity document from IMDS, verifies its RSA-SHA256 signature against the AWS region certificate, and signs the verified host identity into in-toto evidence.

Captures AWS Config compliance state for resources (output of `aws configservice get-compliance-details-by-config-rule` and related calls).

AWS GuardDuty — threat detection findings (CloudTrail/VPC/DNS log analysis).

AWS IAM credential report — per-user MFA + key-rotation + password-age posture.

AWS Inspector v2 — vulnerability + network reachability findings for EC2/ECR/Lambda.

AWS Macie — automated S3 sensitive-data discovery.

AWS Secrets Manager via aws-cli.

AWS Security Hub — central security findings aggregator across AWS services.

Azure Activity Log / Monitor logs.

Azure DevOps Pipelines — Microsoft CI/CD context.

Azure VM IMDS — instance metadata + attested identity document.

Bandit — Python static security analyzer (PyCQA).

Record where the tested commit sits relative to its base branch — head, the base the clone saw, their merge-base, and whether the head includes that base — so a gate can enforce "current with base" against the provider's live base.

Biome: formatter and linter for JavaScript, TypeScript, JSON and CSS.

Bitbucket Pipelines — Atlassian CI/CD context.

Kubernetes SIGs `bom` — SBOM tool for Kubernetes releases (SPDX).

buildctl: the BuildKit client. `buildctl build` drives a buildkitd daemon (local, rootless or a sidecar) to build an OCI image from a Dockerfile.

Buildkite CI/CD context.

The cilock buildpacks attestor parses the CNB lifecycle's report.toml and the io.buildpacks.* label dump, binding a pack build's image digest, run image, buildpack group, and SBOM-layer digest into signed in-toto evidence.

cargo-audit — Rust dependency vulnerability scanner.

cargo build — Rust build orchestrator.

CycloneDX SBOM generator (cdxgen) — multi-language SBOM tool from OWASP.

Scan Terraform, CloudFormation, Kubernetes, Helm, and other IaC with Checkov under cilock — every misconfig becomes a signed v0.3 SARIF attestation.

CircleCI CI/CD context.

clang-tidy: LLVM's C and C++ linter, driven by a compilation database and the repository's .clang-tidy checks.

Google Cloud Build — GCP managed CI.

AWS CloudTrail — AWS account audit log.

CMake: build-system generator for C and C++ (configure with cmake -S . -B build, compile with cmake --build build).

AWS CodeBuild context.

Run GitHub CodeQL under cilock — the SARIF report from `codeql database analyze` becomes a signed v0.3 attestation parsed by the rookery sarif attestor, with the literal codeql argv captured in command-run/v0.2.

The cilock command-run attestor records the executed argv, exit code, captured stdout/stderr, and an optional Linux ptrace forensic record, signed into in-toto evidence.

(no detector.yaml; user-driven or always-on)

(no detector.yaml; user-driven or always-on)

The cilock configuration attestor captures the raw CLI flags and working directory that drove a run, signing them into in-toto evidence.

Sigstore cosign verification.

Cppcheck: static analyzer for C and C++ (undefined behavior, bounds, null pointers, leaks).

The cilock secretscan attestor runs a Gitleaks pattern scan over every product and prior attestor's JSON, with recursive decoding, recording redacted findings into signed in-toto evidence.

(no detector.yaml; user-driven or always-on)

CTest: CMake's test driver; runs the tests a CMake build registers.

Record what a Dagger 1.0 `dagger check` run executed, read from Dagger's own OpenTelemetry trace, as a signed dagger/v0.1 attestation a Rego policy can read field by field.

detect-secrets — Yelp's pre-commit secret scanner.

Captures Docker Bench for Security CIS benchmark results.

Drone — open-source container-native CI.

The cilock editor-extensions attestor signs an inventory of the VS Code, Cursor, Windsurf and VSCodium extensions installed for a user, with a sha256 per file, so a verifier can prove an install matches upstream or flag a tampered one.

The cilock environment attestor captures the host OS, hostname, username, and full process environment with sensitive values obfuscated, signing them into in-toto evidence.

Captures runtime security events from Falco (Cloud Native Computing Foundation runtime threat detection).

Google Cloud Audit Logs (Cloud Logging).

The cilock gcp-iit attestor captures the GCE Instance Identity Token, verifies its signature against Google's JWKS, and signs the resulting GCE host identity into in-toto evidence.

The cilock github-action attestor captures GitHub Action execution metadata — reference, type, inputs/outputs, exit code, and runtime context — signed into in-toto evidence.

The cilock githubwebhook attestor verifies a GitHub webhook payload's HMAC-SHA256 signature and signs the parsed payload and event name into in-toto evidence.

The cilock gitlab-review attestor snapshots the GitLab merge request review state of a commit (approvals bound to the exact sha they approved, approval rules by tier, head pipelines and statuses, unresolved threads) and signs it as in-toto evidence.

Gitleaks — secret detection in git history and source.

go vet: the Go toolchain's static checker.

Run gosec Go SAST under cilock — flags insecure patterns (weak crypto, math/rand, command injection) and emits a signed v0.3 SARIF attestation linked to the commit that produced the code.

gotestsum: runs go test -json and writes JUnit XML.

Scan Go modules for vulnerabilities with reachability via govulncheck under cilock — the SARIF report becomes a signed v0.3 attestation parsed by the rookery sarif attestor.

GnuPG signing — long-form artifact signature.

Gradle — JVM build tool (Java/Kotlin/Groovy/Android).

Scan images or directories for vulnerabilities with Grype under cilock — the SARIF report becomes a signed v0.3 attestation parsed by the rookery sarif attestor, byte-identical to what Grype produced.

Lint Dockerfiles with Hadolint under cilock — pinned base images, package install hygiene, USER root checks, and 100+ other rules become a signed v0.3 SARIF attestation.

helm install / upgrade — Kubernetes chart deployment.

HuggingFace Hub CLI (`hf`) — model card + repo management. Validated by generating a HuggingFace-standard ModelCard README.md and attesting it as a material.

The cilock inclusion-proof attestor binds a single file's digest to a Merkle tree root via an RFC 6962 audit path and signs it into in-toto evidence for downstream per-file verification.

Run Chef InSpec (Progress) compliance profiles under cilock — every CIS, custom Ruby, or dev-sec.io scan becomes a signed v0.1 InSpec attestation linked to the profile and target it scanned.

The cilock instruction-file attestor signs the digests of agent instruction files (CLAUDE.md, AGENTS.md, SKILLS.md, .cursorrules) and records whether the signing credential belongs to a workload or to a human's interactive session.

The cilock jenkins attestor captures Jenkins build metadata from JENKINS_/BUILD_ environment variables and signs it into in-toto evidence, binding an artifact to the pipeline run that produced it.

The cilock jwt attestor parses a JWT, fetches a JWKS, verifies the token signature, and signs the decoded claims plus the verifying key into in-toto evidence as a generic OIDC identity proof.

The cilock k8smanifest attestor walks YAML/JSON Kubernetes manifests, strips ephemeral fields, records per-document digests and container image references, and signs them into in-toto evidence.

KICS — Checkmarx IaC security scanner.

The cilock kube-bench attestor ingests an Aqua Security kube-bench CIS Kubernetes Benchmark JSON report from the step's products and signs a per-check pass/fail/warn summary into in-toto evidence.

kubeaudit — K8s security auditor (Shopify).

kubectl get audit/events — Kubernetes API audit access.

Scan Kubernetes manifests or a live cluster snapshot for NSA/CISA, MITRE, and ArmoBest framework violations with Kubescape under cilock — emits a signed v0.3 SARIF attestation.

kustomize build — declarative K8s manifest customization.

Kyverno — Kubernetes policy management (CNCF).

The cilock link attestor synthesizes an in-toto Link v0.3 predicate from the step's command-run, material, product, and environment attestors and signs it into in-toto evidence for legacy verifiers.

Capture Linkerd service-mesh state under cilock — the native linkerd-check attestor parses `linkerd check -o json` plus optional `linkerd viz edges -o json` into a signed v0.3 attestation with per-category check rollup and per-edge mTLS booleans, gated by Rego for release-time mTLS enforcement.

The cilock lockfiles attestor captures the contents and SHA-256 digest of common package-manager lockfiles in the working tree and signs them into in-toto evidence as a pinned-dependency fingerprint.

malcontent (`mal`) — flags supply-chain-attack capabilities and behaviors in binaries and source (Chainguard).

The cilock material attestor snapshots the working directory before a step runs and emits a single RFC 6962 Merkle-root in-toto subject (tree:materials) over every input file's digest.

The legacy v0.1 material wire format — a flat path→digest map of every input file. Verify-only today; current builds emit material v0.3. Documented for reading pre-cutover attestations.

The cilock maven attestor parses a Maven pom.xml and signs the project coordinates and declared dependencies into in-toto evidence as a static, pre-build dependency record.

Apache Maven `mvn` — JVM dependency + build orchestrator (catalog-only; the maven attestor plugin emits the actual SLSA-style record).

melange — builds apk packages from declarative YAML pipelines (Chainguard); emits an SBOM per package.

Mocha: JavaScript test runner.

Nancy — Sonatype's OSS Index vulnerability scanner for Go modules.

node --test: the Node.js built-in test runner.

notation (Notary v2) — OCI artifact signing.

npm audit — Node.js dependency vulnerability scanner.

npm install / npm ci — Node.js dependency resolution + install.

npm sbom: npm's built-in SBOM generator (CycloneDX or SPDX) for the installed dependency tree.

Run ProjectDiscovery Nuclei under cilock — the SARIF report it emits via -sarif-export becomes a signed v0.3 attestation parsed by the rookery sarif attestor; supports any of Nuclei's ~13,000 community templates.

The cilock oci attestor ingests an OCI/Docker image saved as a tarball product and signs the manifest, image ID, layer diffIDs, and repo tags into in-toto evidence.

The cilock omnitrail attestor captures a content-addressed trail of every file and directory under the working directory with POSIX metadata, signed into in-toto evidence for cross-tool provenance correlation.

Run OpenSCAP (oscap) XCCDF baseline scans under cilock — every SCAP Security Guide profile evaluation becomes a signed in-toto envelope carrying parsed pass/fail/N/A counts plus the raw XCCDF results XML.

pip-audit — Python dependency vulnerability scanner from PyPA.

The cilock pip-install attestor captures the post-build Python package environment via pip, statically analyzes installed code and PyPI PEP 740 provenance, and signs it into in-toto evidence.

The cilock platform attestor binds an attestation to the TestifySec platform tenant and product it was produced under, and records which identity signed in. It is on by default and skips itself when there is no platform identity.

pnpm install — fast disk-efficient Node.js package manager.

Polaris — Fairwinds Kubernetes best-practices validator.

The cilock product attestor snapshots the working directory after a step runs and emits a single RFC 6962 Merkle-root in-toto subject (tree:products) over every output file's digest.

The legacy v0.1 product wire format — a flat path→Product map with per-file MIME and digest, one file subject each. Verify-only today; current builds emit product v0.3.

The legacy v0.2 product wire format — same per-file map as v0.1 but a single tree:products subject via a hand-rolled hash chain. Verify-only today; current builds emit product v0.3.

Protocol Buffers compiler — generates Go/Java/Python/JS bindings from .proto files. Common in monorepos with API codegen pipelines.

Scan AWS, GCP, Azure, Kubernetes, and Microsoft 365 against CIS, NIST, ISO 27001, HIPAA, and PCI-DSS with Prowler under cilock — findings become a signed v0.3 attestation parsed by the native prowler attestor.

RetireJS — JavaScript library vulnerability scanner.

Ruff: Python linter and formatter (pyflakes, pycodestyle, isort, bugbear and more rules).

Safety — Python dependency vulnerability scanner (PyUp).

Capture a Google Workspace tenant's raw configuration with CISA ScubaGoggles under cilock — the provider settings become a signed scubagoggles/v0.1 attestation that your own Rego policy evaluates. Facts in the evidence, verdict in the policy.

(no detector.yaml; user-driven or always-on)

staticcheck — Go static analyzer (Honnef.co/go/tools).

Query AWS, GCP, Azure, Kubernetes, GitHub, and other cloud or SaaS APIs as SQL with Steampipe under cilock — every row becomes a signed v0.1 Steampipe attestation chained to subject digests per identity axis.

(no detector.yaml; user-driven or always-on)

The cilock system-packages attestor records the build host's installed OS package inventory (name and version) before materials are gathered, signing it into in-toto evidence.

JetBrains TeamCity CI/CD context.

Tekton Pipelines — Kubernetes-native CI/CD (CDF).

terraform test: Terraform's native module test runner (run blocks, mock providers).

terraform validate: Terraform's configuration and provider-schema validation.

Terrascan — multi-IaC scanner (Terraform/K8s/Helm/ARM).

Sign JUnit XML or CTRF JSON test reports as a normalized test-results attestation under cilock, and gate on pass/fail counts with Rego that reads input.predicate.summary.

Run testssl.sh TLS connection scans under cilock — the testssl JSON output becomes a signed v0.3 attestation parsed by the rookery sarif attestor, capturing protocol negotiation, cipher matrix, named TLS vulnerabilities, and FIPS 140-2/140-3 compliance findings.

TFLint — Terraform linter for syntax + provider correctness.

tfsec — Terraform-specific static analysis (Aqua Security).

Travis CI context.

TruffleHog — secret + credential scanner (Truffle Security).

tsc: the TypeScript compiler.

uv build: builds a Python project's sdist and wheel through its PEP 517 build backend.

uv export --format cyclonedx1.5: a CycloneDX 1.5 SBOM of a Python project's uv.lock.

uv sync: installs a Python project's environment exactly as its uv.lock pins it.

HashiCorp Vault CLI — secret distribution / dynamic credentials.

The cilock vex attestor captures an OpenVEX document found among a step's product files and attaches it as in-toto evidence under the canonical OpenVEX predicate type URI.

vexctl — OpenVEX statement generation.

yarn audit — Yarn dependency vulnerability scanner.

yarn install — Yarn package manager install.

Run OWASP ZAP DAST scans under cilock — the SARIF report from ZAP's automation framework becomes a signed v0.3 attestation parsed by the rookery sarif attestor, with the literal docker argv captured in command-run/v0.2.

Run Zarf under cilock so `zarf package create` — the air-gap package build — is captured as a signed run where the package tarball becomes a real v0.3 product and the literal zarf argv is recorded in command-run/v0.2.