Frequently Asked Questions
Straight answers about Attest — deterministic compliance attestation for code and repositories by Agents Incorporated. If your question isn’t here, write to support@agentsincorporated.ai.
What is Attest?
Attest is a compliance-attestation platform for source code, built by Agents Incorporated. It checks a repository against the technical controls of 65 compliance frameworks — HIPAA, SOC 2, PCI DSS, GDPR, ISO 27001, NIST 800-53, the OWASP LLM Top 10, and more — using deterministic security scanners, and produces a signed, evidence-backed attestation report in minutes.
How does Attest work?
You connect a repository read-only. Attest runs industry-standard scanners — Semgrep for static analysis, gitleaks for secrets, osv-scanner for known-vulnerable dependencies, and checkov for infrastructure-as-code — and maps every finding to the exact control clause of each framework you select, citing the tool, the rule, and the file and line. The result is a scored report in which every verdict (Met, Partially met, Gap, or Out of scope) links to the evidence behind it.
What does "deterministic" mean, and why does it matter for compliance?
Deterministic means the same code always yields the same verdicts. Attest’s verdicts come from reproducible scanner output, not from a language model’s judgment, so re-running a scan on the same commit returns the same result — and your auditor can run the same open-source tools on the same code and reproduce the evidence independently. A tool that uses AI to grade code can disagree with itself between two runs on identical input; evidence handed to an auditor should not.
Is Attest just another AI code-review tool?
No — it is closer to the opposite. Attest is a deterministic engine first: real scanners produce the findings and the verdicts. AI is used only for the small number of controls that no scanner can measure, and those verdicts are explicitly labeled "AI-assessed" and kept clearly separated from the deterministic ones.
Which compliance frameworks does Attest cover?
65 frameworks, including HIPAA (Security Rule §164.312), SOC 2 (Security / Common Criteria), PCI DSS v4.0.1, GDPR (Art. 32), ISO 27001:2022, ISO 27701, NIST CSF 2.0, NIST SP 800-53 (the FedRAMP and FISMA baseline), NIST SSDF, OWASP Top 10, OWASP LLM Top 10, CIS Controls v8, GLBA, CCPA/CPRA, CMMC 2.0, NYDFS 500, NERC CIP, SLSA and SBOM supply-chain integrity, NIS2, DORA, and more. The same scan evidence maps to every framework you select, so checking additional frameworks does not require additional scans.
Does Attest issue SOC 2 reports or HIPAA certifications?
No. Attest is not an auditor or a certification body, and it does not issue certifications of any kind. It produces reproducible technical evidence — per-control verdicts with file:line citations — for the controls visible in source code. Policies, business associate agreements, and physical safeguards remain with your auditor; Attest hands them the technical evidence for the code.
What is the Attest PR Gate?
The PR Gate checks every pull request against your compliance baseline before it merges. Each PR is diffed against the base branch, and Attest posts a comment with the score, the change against the baseline, and every new finding at file:line — for every framework you have enabled, each in parallel. It is advisory by default: Attest comments, and the merge is not blocked. When you want a specific PR enforced, add the attest-block label to it — that run fails the check if the PR introduces new findings, and removing the label makes the next run advisory again.
What access does Attest need to my repository?
Read-only access, and nothing else. Attest reads the code as-is: it never modifies a repository, requires no build, no toolchain, and no CI changes, and works with any language or stack.
How much does Attest cost?
A one-time report for a single repository and framework is $19. The Team plan is $99 per month for up to 5 repositories with all frameworks, the PR Gate, auditor-shareable reports, and audit history. The Business plan is $499 per month with unlimited repositories. Enterprise pricing (private frameworks, CI/API integration, SLA) is custom — contact support@agentsincorporated.ai.
Can my auditor rely on an Attest report?
Every report is frozen, hashed, and signed, with a public verification link, and every verdict cites the tool, rule, and file:line evidence behind it. Because the scanners are deterministic and open, an auditor who does not trust Attest can run the same tools on the same commit and reproduce the findings — the report is built to be checked, not believed.
How long does a scan take?
Minutes. Connect a repository and you hold a signed, evidence-backed compliance report before your next standup — compared with the weeks a manual evidence-collection pass typically takes.
See what a deterministic attestation of your own repository looks like.
Get a One-Time Report