diff --git a/docs/cli/ci.mdx b/docs/cli/ci.mdx
index 700935cc01..79928d185e 100644
--- a/docs/cli/ci.mdx
+++ b/docs/cli/ci.mdx
@@ -242,6 +242,32 @@ Run the server-side MCP Apps surface checks from a config file and publish JUnit
 
 Single-run `protocol conformance`, `oauth conformance`, and `apps conformance` also accept `--reporter junit-xml` when you only need one target/check selection instead of a suite config file.
 
+### Optional: verify Tool Outcome Attestation (TOA) after doctor / conformance
+
+Doctor and protocol conformance cover connect, capabilities, and protocol behavior. [Tool Outcome Attestation](https://github.com/Carmel-Labs-Inc/toa) (`toa/0.1`) is a separate, Ed25519-signed JSON artifact (Apache-2.0 project) for **tool delivery** grades (reach, invoke, functional, shape, and related layers). It is not a wire protocol and is not meant to run on every live `tools/call`.
+
+If your pipeline already has a `toa.json` from AgentStatus (or another emitter whose key you pin), you can fail the job when verify fails. The example below requires `emitter.name=agentstatus` and uses the packaged AgentStatus key; pass `--public-key` for another issuer. No AgentStatus account is required to verify.
+
+```yaml
+      - name: Doctor
+        run: npx -y @mcpjam/cli@latest server doctor --url ${{ secrets.MCP_SERVER_URL }} --format json
+
+      - name: Protocol conformance
+        run: |
+          npx -y @mcpjam/cli@latest protocol conformance \
+            --url ${{ secrets.MCP_SERVER_URL }} \
+            --reporter junit-xml > protocol-report.xml
+
+      # Optional. Skip when toa.json is absent.
+      - name: Verify tool delivery attestation
+        if: hashFiles('toa.json') != ''
+        run: |
+          pip install "git+https://github.com/Carmel-Labs-Inc/toa.git@99e2690fec24a5290d9542e58383a8bf753e8b74#subdirectory=python"
+          toa-verify toa.json --require-emitter agentstatus --require-layer functional=pass --max-age 7d
+```
+
+Pin the emitter public key using the flags documented in the toa repo when you need a specific signer.
+
 ---
 
 ## GitLab CI