@asterpay/attest-sdk

Attest — EU AI Act compliance in one SDK

Powered by AsterPay — trust & settlement for AI commerce.

Attest helps EU teams discover AI usage in code, classify risk heuristically, generate Annex IV-style documentation scaffolds, and keep tamper-evident audit logs for AI inferences.

Not legal advice. Attest is a developer tool. Always involve qualified counsel for conformity assessment and regulatory obligations.

Try it now (zero install)

cd your-project
npx @asterpay/attest scan

That's it. Attest scans your TypeScript/JavaScript source for AI SDK imports (OpenAI, Anthropic, Google AI, LangChain, etc.) and reports what it finds:

📦 Scanned 42 files in ./src

  src/chat/agent.ts
    → openai (line 1)        ai-sdk
    → @anthropic-ai/sdk (line 2)

  src/scoring/classifier.ts
    → langchain (line 3)     ai-sdk

🔍 3 AI-related imports found across 2 files
⚠️  Risk classification: HIGH (Annex III keywords detected)

Install

npm install -g @asterpay/attest

Quick start

cd your-project

# 1) See which AI SDKs your code imports (AST scan)
attest scan

# 2) Heuristic checks: transparency / logging / oversight signals
attest check

# 3) Generate Annex IV–style Markdown scaffolds (fill with counsel)
attest docs -o ./compliance

# 4) Local static dashboard (countdown + CLI hints)
attest dashboard

What each command does

Step	Command	What you get
Scan	attest scan	List of every AI SDK import in your codebase, file by file
Check	attest check	Compliance signals: do you have logging? transparency disclosures? human oversight patterns?
Docs	attest docs -o ./compliance	Three Markdown files: technical-documentation.md, risk-assessment.md, conformity-declaration.md — pre-filled scaffolds for Annex IV, ready for your legal team
Dashboard	attest dashboard	Local web UI with EU AI Act deadline countdown + quick links

Packages

Package	npm	Description
@asterpay/attest		CLI (attest) + re-exports SDK
@asterpay/attest-sdk		Programmatic API

CLI reference

Command	Purpose
attest scan [-r DIR]	List AI-related package imports per file
attest check [-r DIR]	Compliance signals (not legal sign-off)
attest docs -o DIR [-r DIR] [--name] [--provider]	Write technical-documentation.md, risk-assessment.md, conformity-declaration.md
attest export [--from ISO]	Dump audit log JSON (needs prior Attest.track() usage)
attest verify [-r DIR]	Verify audit JSONL hash chain; exits 1 if broken
attest dashboard [-p PORT]	Serve local dashboard

Project metadata for attest docs (optional): .attest/config.json — see below.

Optional project metadata (for attest docs):

// .attest/config.json
{
  "system": {
    "name": "Customer Support Bot",
    "provider": "Your Company Ltd",
    "description": "Tier-1 support assistant"
  }
}

Programmatic usage

import { Attest } from '@asterpay/attest';

const attest = new Attest({
  system: {
    name: 'My AI feature',
    provider: 'My Org',
  },
  projectRoot: process.cwd(),
});

const risk = await attest.classifyRisk();
const report = attest.check();

await attest.track(
  async () => {
    /* your OpenAI / Anthropic call */
    return { ok: true };
  },
  { purpose: 'support', humanOversight: 'available', containsPII: false },
);

Monorepo layout

attest/
  packages/
    sdk/     @asterpay/attest-sdk
    cli/     @asterpay/attest
  landing/   marketing site (static)
  docs/      publishing, domains, cloud roadmap

Why?

The EU AI Act (Regulation 2024/1689) requires companies deploying AI in the EU to document, classify, and audit their AI systems. The August 2, 2026 deadline for high-risk systems is approaching fast.

Attest doesn't replace legal counsel — it gives your engineering team a head start:

• Discovery — "Which of our 200 microservices actually use AI SDKs?"
• Risk signal — "Does our code have the logging/oversight patterns regulators expect?"
• Documentation — "Give us Annex IV scaffolds so legal doesn't start from a blank page"
• Audit trail — "Every AI inference is logged with SHA-256 hash chaining"

Contributing

git clone https://github.com/AsterPay/attest
cd attest
npm install
npm run build
npm test

See docs/GITHUB_SETUP.md and docs/PUBLISH.md for setup and publishing details.

License

MIT © AsterPay contributors