Attest — Proof layer for AI agents

Decide → Gate → Verify → Attest. When an AI agent takes an action in the real world, Attest decides whether it may, gates it behind a human when it matters, verifies from the system of record that it actually happened, and records tamper-evident evidence.

Attest is not an agent framework, not a connector platform, not a guardrail filter. It is the layer that lets a team say, with proof: "this agent did exactly this, as this person, and it worked."

Read in this order

Quickstart

Brand Attest · PyPI attestlayer · npm attestlayer · deploy runbook in DEPLOY.md.

TypeScript — on npm today:

npm install attestlayer

import { Attest } from "attestlayer";

const at = new Attest({ agent: "followup-agent@v3", readers: { gmail: process.env.GMAIL_TOKEN! } });
const sendEmail = at.wrap({ system: "gmail", verb: "send", target: "to" },
                          async ({ to, subject, body }) => gmail.send({ to, subject, body }));

await sendEmail({ to: "arun@newco.com", subject: "Proposal", body: "…" });

Python — same contract, same ledger format:

pip install attestlayer              # publishing pending; today: pip install -e ".[dev]"

import attest

@attest.action(system="gmail", verb="send", target="to")
def send_email(to, subject, body): ...

The first external send pauses for a human; the ledger row says acknowledged, or verified once Attest can read back with the agent's own credentials (Attest(readers={"gmail": service})). attest ledger · attest verify. Full docs: mkdocs serve → docs/site.

Repository

pytest -q && (cd cloud && pytest -q)                   # 273 + 21 tests
ATTEST_AUTO_APPROVE=1 python examples/langgraph_agent.py
cd deploy && cp .env.example .env && docker compose up  # cloud + dashboard

One-line rules

• We never execute the customer's action. Their tool executes; we observe, decide, gate, verify, record.
• Coverage is universal (any app, any action, any framework, any language). Verification depth is layered and honest.
• Open-source SDK (MIT). Paid cloud (ledger, confirm inbox, policies, exports).
• Developer-led, self-serve, USD. No enterprise sales motion in year one.

Install from registries

Lineage

Attest is extracted from two working codebases: DO (policy engine, read-back verification pairs, evidence ledger, Nango auth) and DeerFlow (tool receipts, verification patterns, MCP/IM channel adapters). Nothing here is theoretical — every core mechanism already runs against real Gmail, Slack, HubSpot, Notion, Linear and Google Workspace.