SDK quickstart

Docs

Install Matrix Scroll, add the Git hooks, and verify signed commit envelopes today. The same format can later support secure enclaves and SSH-agent keychains without changing verification.

Install 0.6.1 Try the verifier View GitHub

Quick start

Install, hook, and verify a signed commit envelope in a few commands.

Public contract

Every example maps back to the same published byte rules and public schemas.

Start with proof

Use the browser verifier and PR gate before you spend time on deeper rollout work.

Shipping now

PyPI 0.6.1, Git hooks, the browser verifier, and PR-range checks through the GitHub Action.

In progress

Transparency-log integrations and custom validation policies for enterprise environments.

Scope

Matrix Scroll adds commit provenance. It does not replace IAM, sandboxing, or build attestations.

Why it exists Protocol flow Threat model Browser verifier Matrix Scroll MCP Compare page PyPI provenance Conformance vectors GitHub Action Tests and policy docs

installv0.6.1

pip install "matrixscroll==0.6.1"
matrixscroll hook-install
matrixscroll hook-status

agent commitpost-commit hook

export MATRIXSCROLL_ACTOR_TYPE=agent
export MATRIXSCROLL_TOOL=agent-runner
git commit -m "feat: agent change"
matrixscroll envelope-verify "$(git rev-parse HEAD)"

MCP installv0.6.1

pip install "matrixscroll[mcp]==0.6.1"
{
  "mcpServers": {
    "matrixscroll-mcp": {
      "command": "matrixscroll-mcp"
    }
  }
}

CI gatev0.6.1

- uses: SSX360/matrixscroll-verify-action@v1
  with:
    matrixscroll-version: "0.6.1"
    require-mode: emulated

Hooks default to warn mode; set "enforce": true in .git/matrixscroll/config.json to block failed signing. Windows support landed in 0.2.1; the public examples on this page pin 0.6.1. Source of truth: GitHub, SPEC.md, whitepaper.

Threat Model & L1 Security Limits

Matrix Scroll L1 software mode proves possession of the private signing seed file, not the verified physical identity of the human developer. A compromised machine or an attacker with write access to your local filesystem can sign envelopes that verify successfully in CI. Actor binding under emulated mode remains advisory. For the full specification of cryptographic assumptions, see the whitepaper.

Resources

Read the proof before you roll it out.

Tutorial

Add commit provenance to a repo in 5 minutes.

The shortest path from installation to a verifiable commit envelope in a real repository.

Open guide

Comparison

Commit-time proof vs artifact-time proof.

See exactly where Matrix Scroll fits alongside Sigstore, GitHub attestations, and SLSA.

Read comparison

Adopter kit

Run a small pilot without changing your workflow.

One repository, one PR gate, and one clear success metric for teams evaluating the SDK.

Open adopter kit

Matrix Scroll MCP

Use the public MCP with the SDK.

Install the MCP in Cursor, VS Code, or Claude Desktop to audit proof surfaces, preview editor integration safely, and generate a public rollout plan around the SDK.

quickstart-mcp MCP guide

Roadmap

Track the rollout milestones.

Stabilization, first adopter proof, and the next protocol integration phases in our roadmap.

See the rollout phases