AI Attestation

An open standard for tracking AI generated code in your repository.

AI Attestation is a machine readable YAML file placed in your repository root that tracks which AI coding tools were used, how much code they generated, and whether that code has been governance scanned.

Why

Enterprises, open source maintainers, and compliance teams increasingly need to answer:

• How much of this codebase was written by AI?
• Which AI tools were used?
• Has the AI generated code been reviewed or scanned?

AI Attestation provides a single, standardized file that answers all three.

Quick Start

npx @korext/ai-attestation init

This will:

1. Scan your git history for AI tool signatures
2. Create .ai-attestation.yaml in your repo root
3. Install a post-commit hook to keep it updated

That's it. The file updates automatically on every commit.

What It Detects

AI Attestation identifies tools through publicly observable signals:

Supported Tools

Missing a tool? Add it

The File

# AI Attestation
# https://oss.korext.com/ai-attestation

schema: https://oss.korext.com/ai-attestation/schema
version: "1.0"

repo:
  owner: acme
  name: payments-service
  url: https://github.com/acme/payments-service

generated: "2026-04-15T12:00:00Z"

range:
  from: "2025-01-01T00:00:00Z"
  to: "2026-04-15T12:00:00Z"
  commits: 1247

ai:
  assisted_commits: 438
  percentage: 35.1
  tools:
    - name: GitHub Copilot
      identifier: copilot
      first_seen: "2025-09-01"
      last_seen: "2026-04-15"
      commit_count: 312

    - name: Cursor
      identifier: cursor
      first_seen: "2026-01-15"
      last_seen: "2026-04-14"
      commit_count: 89

  detection_methods:
    - co-author-trailer
    - commit-message-pattern

See more examples in examples/.

CLI Commands

# Initialize (scan + create file + install hook)
ai-attestation init

# Re-scan and update
ai-attestation scan

# Print attestation summary
ai-attestation report

# Generate badge markdown
ai-attestation badge

# Manage git hooks
ai-attestation hook install
ai-attestation hook remove
ai-attestation hook install --type pre-commit

GitHub Action

Enforce AI code policies in CI:

# .github/workflows/ai-attestation.yml
name: AI Attestation
on: [push, pull_request]

jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: korext/ai-attestation@v1
        with:
          minimum-governance-score: 80
          block-unscanned: true
          mandatory-packs: security

Action Inputs

Action Outputs

Governance

The governance section is designed to be populated by any governance engine. When configured, a governance engine reads the attestation file, scans the AI generated code, and writes its results back:

governance:
  engine: KOREXT
  last_scan: "2026-04-15T10:00:00Z"
  result: PASS
  score: 94
  packs:
    - security
    - modernization
  findings:
    critical: 0
    high: 1
    medium: 3
    low: 7

The governance section is engine-agnostic. Any tool can populate it.

Privacy

AI Attestation processes git metadata only:

• Commit messages
• Author names and emails
• Commit dates

It never reads source code. All processing happens locally. No network calls. No telemetry. The output file contains only aggregate counts.

Specification

The full specification is available at SPEC.md. The JSON Schema is available at schema.json.

Both are released under CC0 1.0 Universal (public domain).

Badge

Add a badge to your README after running ai-attestation init:

ai-attestation badge

This outputs markdown you can paste into your README:

[![AI Attestation](https://oss.korext.com/api/badge/owner/repo)](https://oss.korext.com/ai-attestation/report/owner/repo)

Contributing

See CONTRIBUTING.md for guidelines on adding new tools, reporting false positives, and proposing spec changes.

License

• Code (CLI, action, tools): Apache License 2.0
• Specification & Schema: CC0 1.0 Universal (public domain)

Related Projects

Built by Korext | oss.korext.com/ai-attestation