Results for “attestation”

Assigns behavioral trust grades (A–F) to MCP servers by running probes for prompt injection, permission overreach, data leaks, and adversarial-input handling, and publishes reproducible onchain attestations.

Use to sign off a QA period for audit or governance — stating what is being attested to, on what evidence, and with which limitations. Trigger for "sign off the QA period", "attest to our quality results", "monthly QA governance pack", "certify the quality figures", or being asked to confirm quality was assured for a period.

Sign and verify container image provenance using Sigstore Cosign with keyless OIDC-based signing, attestations, and Kubernetes admission enforcement.

Validates Claude Ads contracts, bundles, scores, runs, capabilities, repositories, and releases with deterministic checks and recovery steps.

Verifies that every entry in a bibliography ACTUALLY EXISTS by cross-checking it against four keyless public scholarly APIs (Crossref, OpenAlex, Semantic Scholar, arXiv) with a polite mailto identifier, resolving DOI/arXiv IDs, fuzzy-matching title and authors (difflib SequenceMatcher ratio >=0.70), flagging retractions marked in Crossref (update-to) or OpenAlex (is_retracted), and emitting per-entry JSON verdicts mapped to the AlterLab citation-hallucination taxonomy (TF/PAC/IH/PH/SH). Accepts BibTeX, a DOI/arXiv ID list, or free-form references; degrades gracefully offline by emitting 'unverified' verdicts and never silently passing. Use when the request mentions verify citations, check references, fabricated or hallucinated references, fake DOI, retraction check, bibliography audit, or reference existence check. Does NOT write or draft papers — for authoring a manuscript (whose citation-check mode inserts citations) prefer alterlab-paper-writer instead. Part of the AlterLab Academic Skills suite.

Authentication and credential security assessment. Tests password brute-force, credential stuffing, password spraying, default credential testing, credential harvesting, lockout analysis, MFA bypass, OAuth/OIDC abuse, session token entropy, Kerberos attacks, and intelligent wordlist generation. Uses hydra, john, ncrack, medusa, cewl, crunch, netexec, impacket, kerbrute, and nuclei default-login templates. Covers OWASP A07:2021 Identification and Authentication Failures.

Produces a decision-grade dossier on a specific company, person, nonprofit, or government org by testing the user's hypothesis rather than confirming it. Outputs an editable Word document with verdict, identity facts, 12-month activity timeline, network and reputation signals, and red flags.

Authenticate AI agents with services using ERC-8004 onchain identity via Sign-In With Agent (SIWA).

Extend Microsoft Entra ID authentication flows with custom claims, attribute collection, and OTP delivery using Azure Functions triggers.

Prepare ISO 13485:2016 certification documentation for medical device Quality Management Systems, including gap analysis, template-based document creation, and compliance checklists.

Audit and manage dependencies across multi-language projects by scanning for vulnerabilities, license conflicts, and transitive dependency risks, with safe-upgrade planning.

Audits type safety documentation against the live codebase and fixes errors, gaps, or stale information to keep docs authoritative.

Exhaustive audit for stubs, dead buttons, fake components, unwired handlers, and dead links — then a wiring plan, no implementation. Use when "find dead buttons", "stub checker", "fake components", "unwired handlers", or "dead links". Live QA → test-qa.

Verify a completed implementation against the original instructions, a declarative source document, an issue brief, or an optional MoonSpec feature packet, plus AGENTS.md repo guidance and required tests. Use when the user asks to run or reproduce `/moonspec.verify`, perform a final read-only implementation check, audit unit and integration test evidence, classify requirement coverage, or decide whether more code or test work is needed.

Enforce deploy-time security controls that ensure only trusted, attested container images are deployed to Google Kubernetes Engine and Cloud Run.

Generate CycloneDX and SPDX SBOMs from container images and filesystems, scan them for vulnerabilities with Grype, and sign attestations with Cosign for supply-chain trust.