Native library reference. Extended CLI examples use jacs-compat. This source reference can include unreleased changes; see the package guide for installation and MCP profiles for available tools.

CLI Reference: jacs-compat attest

The jacs-compat attest command creates and verifies attestation documents from the command line. Attestation extends basic signing with structured claims, evidence references, and derivation chains.

jacs-compat attest create

Create a signed attestation document.

Synopsis

jacs-compat attest create --claims '<JSON>' [options]

Options

Examples

Create a basic attestation:

jacs-compat attest create \
  --subject-type artifact \
  --subject-id "doc-001" \
  --subject-digest "abc123def456..." \
  --claims '[{"name": "reviewed_by", "value": "human", "confidence": 0.95}]'

Attestation with multiple claims:

jacs-compat attest create \
  --subject-type agent \
  --subject-id "agent-abc" \
  --subject-digest "sha256hash..." \
  --claims '[
    {"name": "reviewed", "value": true, "confidence": 0.95},
    {"name": "source", "value": "internal_db", "assuranceLevel": "verified"}
  ]'

Lift an existing signed document to attestation:

jacs-compat attest create \
  --from-document mydata.signed.json \
  --claims '[{"name": "approved", "value": true}]'

With evidence references:

jacs-compat attest create \
  --subject-type artifact \
  --subject-id "report-456" \
  --subject-digest "def789..." \
  --claims '[{"name": "scanned", "value": true}]' \
  --evidence '[{
    "kind": "custom",
    "digests": {"sha256": "evidence-hash..."},
    "uri": "https://scanner.example.com/results/123",
    "collectedAt": "2026-03-04T00:00:00Z",
    "verifier": {"name": "security-scanner", "version": "2.0"}
  }]'

Write to file:

jacs-compat attest create \
  --subject-type artifact \
  --subject-id "doc-001" \
  --subject-digest "abc123..." \
  --claims '[{"name": "ok", "value": true}]' \
  -o attestation.json

jacs-compat attest verify

Verify an attestation document.

Synopsis

jacs-compat attest verify <FILE> [options]

Arguments

Options

Examples

Basic verification (local tier):

jacs-compat attest verify attestation.json

Output:

Attestation verification: VALID
  Signature: OK
  Hash: OK
  Signer: agent-id-abc123
  Algorithm: ring-Ed25519

Full verification:

jacs-compat attest verify attestation.json --full

Output:

Attestation verification: VALID
  Signature: OK
  Hash: OK
  Signer: agent-id-abc123
  Algorithm: ring-Ed25519
  Evidence: 1 item(s) verified
    [0] custom: digest OK, freshness OK
  Chain: not present

JSON output (for scripting):

jacs-compat attest verify attestation.json --json

Output:

{
  "valid": true,
  "crypto": {
    "signature_valid": true,
    "hash_valid": true,
    "signer_id": "agent-id-abc123",
    "algorithm": "ring-Ed25519"
  },
  "evidence": [],
  "chain": null,
  "errors": []
}

Verify with external keys:

jacs-compat attest verify attestation.json --key-dir ./trusted_keys/

Pipe through jq:

jacs-compat attest verify attestation.json --json | jq '.crypto'

Piping and Scripting Patterns

Create and verify in one pipeline

jacs-compat attest create \
  --subject-type artifact \
  --subject-id "doc-001" \
  --subject-digest "abc..." \
  --claims '[{"name": "ok", "value": true}]' \
  -o att.json && \
jacs-compat attest verify att.json --json | jq '.valid'

Check validity in a script

#!/bin/bash
set -e

RESULT=$(jacs-compat attest verify "$1" --json 2>/dev/null)
VALID=$(echo "$RESULT" | jq -r '.valid')

if [ "$VALID" = "true" ]; then
    echo "Attestation is valid"
    exit 0
else
    echo "Attestation is INVALID"
    echo "$RESULT" | jq '.errors'
    exit 1
fi

Batch verify multiple attestations

for file in attestations/*.json; do
    echo -n "$file: "
    jacs-compat attest verify "$file" --json | jq -r '.valid'
done

Exit Codes

Environment Variables

See Also

• Sign vs. Attest Decision Guide
• Attestation Tutorial
• Attestation Verification Results
• CLI Command Reference