Skip to content

Docs: optional TOA verify after doctor/conformance in CI #4498

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dulrajnr wants to merge 6 commits into
base: main
Choose a base branch
from
Open

Docs: optional TOA verify after doctor/conformance in CI #4498

Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
9f1297d
Docs: optional TOA verify after doctor/conformance in CI.
AgentStatus-Dev Aug 30, 2026
e91f3c7
Docs: pin toa-verify install to a commit SHA.
dulrajnr Aug 30, 2026
7b7e0fc
Docs: pin emitter and max-age on toa-verify examples
AgentStatus-Dev Aug 31, 2026
12b2975
Docs: pin toa-verify to packaged-key release
AgentStatus-Dev Aug 31, 2026
da3880e
Docs: align TOA emitter prose with --require-emitter example
AgentStatus-Dev Aug 31, 2026
a8ce317
Docs: separate TOA license from signature description
AgentStatus-Dev Aug 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 26 additions & 0 deletions docs/cli/ci.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -242,6 +242,32 @@ Run the server-side MCP Apps surface checks from a config file and publish JUnit

Single-run `protocol conformance`, `oauth conformance`, and `apps conformance` also accept `--reporter junit-xml` when you only need one target/check selection instead of a suite config file.

### Optional: verify Tool Outcome Attestation (TOA) after doctor / conformance

Doctor and protocol conformance cover connect, capabilities, and protocol behavior. [Tool Outcome Attestation](https://github.com/Carmel-Labs-Inc/toa) (`toa/0.1`) is a separate, Ed25519-signed JSON artifact (Apache-2.0 project) for **tool delivery** grades (reach, invoke, functional, shape, and related layers). It is not a wire protocol and is not meant to run on every live `tools/call`.

If your pipeline already has a `toa.json` from AgentStatus (or another emitter whose key you pin), you can fail the job when verify fails. The example below requires `emitter.name=agentstatus` and uses the packaged AgentStatus key; pass `--public-key` for another issuer. No AgentStatus account is required to verify.

```yaml
- name: Doctor
run: npx -y @mcpjam/cli@latest server doctor --url ${{ secrets.MCP_SERVER_URL }} --format json

- name: Protocol conformance
run: |
npx -y @mcpjam/cli@latest protocol conformance \
--url ${{ secrets.MCP_SERVER_URL }} \
--reporter junit-xml > protocol-report.xml

# Optional. Skip when toa.json is absent.
- name: Verify tool delivery attestation
if: hashFiles('toa.json') != ''
run: |
pip install "git+https://github.com/Carmel-Labs-Inc/toa.git@99e2690fec24a5290d9542e58383a8bf753e8b74#subdirectory=python"
toa-verify toa.json --require-emitter agentstatus --require-layer functional=pass --max-age 7d
Comment thread
coderabbitai[bot] marked this conversation as resolved.
```

Pin the emitter public key using the flags documented in the toa repo when you need a specific signer.

---

## GitLab CI
Expand Down