
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
@lockstep-ai/lockstep
Advanced tools
Cryptographic verification for AI coding agents. Stop trusting your AI agent — verify it.
Cryptographic verification for AI coding agents.
Stop trusting your AI agent. Verify it.
Define steps. Set validation criteria. Let the agent work. Lockstep generates a verifiable execution receipt proving every step passed.
npm install -g @lockstep-ai/lockstep
lockstep setup
Choose between using your Claude subscription (zero setup) or an Anthropic API key.
Create a spec from a template:
lockstep init nextjs-saas
Or write your own .lockstep.yml:
version: "1"
config:
agent: "claude-code"
max_retries: 3
step_timeout: 300
context: |
Building a REST API with Express.js and TypeScript.
steps:
- name: "Initialize project"
prompt: |
Create an Express.js project with TypeScript.
Set up tsconfig.json, install dependencies, create src/index.ts.
validate:
- type: file_exists
target: "package.json"
- type: file_exists
target: "src/index.ts"
- type: file_contains
path: "package.json"
pattern: "express"
- name: "Add tests"
prompt: |
Write tests for the API using Jest.
validate:
- type: test_passes
command: "npm test"
- type: ai_judge
criteria: |
Are the tests comprehensive? Score 1-10.
threshold: 6.0
evaluation_method: "file_content"
evaluation_targets:
- "src/__tests__/"
Run it:
lockstep run
Lockstep executes each step, validates the results, and produces a cryptographic receipt chaining every step together.
Anyone with the receipt can independently verify the hash chain:
lockstep verify .lockstep/receipt.json
| Type | Description |
|---|---|
file_exists | File exists at path |
file_not_exists | File does not exist |
file_contains | File matches a pattern |
file_not_contains | File does not match a pattern |
command_passes | Shell command exits 0 |
command_output | Command stdout matches pattern |
api_responds | HTTP endpoint returns expected status |
json_valid | File contains valid JSON |
type_check | TypeScript type checking passes |
lint_passes | Linter passes |
test_passes | Test command passes |
ai_judge | AI evaluation against your criteria |
lockstep init <template>
lockstep templates # list all
| Template | Description |
|---|---|
blank | Empty starter |
nextjs-saas | Full-stack Next.js SaaS app |
rest-api | Express.js REST API with TypeScript |
solana-program | Solana program with Anchor |
| Command | Description |
|---|---|
lockstep run [spec] | Execute a spec and generate a receipt |
lockstep validate [spec] | Validate a spec without running |
lockstep init [template] | Create a spec from a template |
lockstep verify <receipt> | Verify a receipt's integrity |
lockstep templates | List available templates |
lockstep setup | Configure authentication |
Run options: --dry-run, --step <n>, --from <n>, --verbose, --no-color, --output <path>
| Agent | Status |
|---|---|
| Claude Code | Supported |
| Cursor | Coming soon |
| GitHub Copilot | Coming soon |
MIT
FAQs
Cryptographic verification for AI coding agents. Stop trusting your AI agent — verify it.
The npm package @lockstep-ai/lockstep receives a total of 0 weekly downloads. As such, @lockstep-ai/lockstep popularity was classified as not popular.
We found that @lockstep-ai/lockstep demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.