OpenViSTAI · Agents · Blockchain · Crypto
Submit a project
Menu
Agent Infrastructure

Chainloop

Chainloop is open-source software-delivery infrastructure that records AI coding-agent sessions and CI/CD artifacts as signed, timestamped in-toto attestations, then checks those records against workflow contracts and policy-as-code rules. It can connect policy failures to CI/CD outcomes, including failing a pipeline.

Explore the practical guide ↓

Independent OpenViST project profile, based on linked sources.

Chainloop — OpenViST project profile in Agent Infrastructure.
OpenViST project illustration. See the linked sources for product details.
Understand the project

Practical overview

When it fits

Use Chainloop when delivery requirements need to be checked across agent activity and CI/CD evidence, rather than handled as separate advisory results in individual tools.

Who it is for

  • Engineering teams integrating AI coding agents into software delivery.
  • Teams seeking policy checks across CI/CD runs, SBOMs, scans, test reports and provenance.

Documented uses

  • Record agent sessions and associate them with commits and releases.
  • Collect signed evidence from CI jobs, including SBOMs, security scans, test reports and SLSA provenance.
  • Enforce requirements such as approved models, passing tests, or an SBOM for each release.
  • Return policy violations through the pipeline so an agent can revise its work.
Before you choose

Requirements & limits

The project is open source under Apache 2.0 and described as self-hostable.

  • Workflow contracts specify required outputs, while policies can be written in Rego or WASM.
  • Attestations can be stored in an OCI registry, S3 or Azure Blob.
  • The project is written in Go and built on Sigstore and in-toto.
  • Adoption involves defining contracts and policies and connecting the existing delivery workflow.

Check current requirements in the official documentation. Source-based guidance does not mean OpenViST has run or independently tested this project.

Source-based practical guide

Define and apply a build contract with an SBOM license policy

Configure a contract that requires a container image and CycloneDX SBOM and gates the workflow on the referenced license policy.

Before you start

  • A Chainloop contract in YAML.
  • A policy reference for CycloneDX license checks.

Steps

  1. Create a contract with apiVersion: chainloop.dev/v1 and kind: Contract.

  2. In spec.materials, require an image of type CONTAINER_IMAGE and an sbom of type SBOM_CYCLONEDX_JSON.

  3. Set the runner type to GITHUB_ACTION and add the CycloneDX license policy reference under spec.policies.materials with gate: true.

  4. Apply the contracts directory with chainloop apply -f ./contracts/.

Expected outcome

The contract is applied, and the license policy is configured as a gate for the required materials.

Guide limitations

  • The documented contract example configures the gate; it does not describe setting up Chainloop or a GitHub Actions workflow.
  • The example describes blocking a push when an SBOM component has no license; it does not provide a full pipeline execution or verification procedure.
Documentation 1 ↗Documentation 2 ↗
Evidence and transparency

Sources & review

Official repository ↗Guide documentation ↗
Source record details
Source availability
Active
Sources checked
12 October 2026
Original website title
chainloop-dev/chainloop · Official homepage title · retained in its source language
How we review sourcesSuggest a correction