Quickstart: from detecting to proving (Pro)
You're already using the free tier for API checks. The GitHub Action can sign its OpenAPI report with Sigstore when configured, without Pro. Pro lifts the Free limit on local delimit wrap records.
Action report signing and local CLI records are separate workflows.
What the attestation is
delimit wrap writes a local delimit.attestation.v1 record with the repo state, changed files, gate results, and an HMAC signature using a local key. Hosted replay is not available.
delimit wrap gates any AI-assisted CLI invocation — advisory-first, like everything else. Bundles land in ~/.delimit/attestations/.
Separately, published Seal release receipts can be verified offline without an account:
npx delimit-cli seal-verify receipt.json # offline: Ed25519 signature + content pin
See it on real specs first
Before paying for anything, look at the worked examples — real, reproducible merge-gate runs against public API specs (Stripe, OpenAI, Anthropic, cal.com, and others):
- Index: delimit.ai/reports
- Schema and signing methodology behind every report: delimit.ai/methodology/mcp-attestation
You can also run the attestation methodology check locally against your own repo (preview only, writes .delimit/attestation-preview.json):
npx delimit-cli attest mcp
What Pro unlocks
On top of the free merge gate (lint, diff, semver, scan, ledger, local memory):
| Capability | Tools |
|---|---|
| Evidence collection | delimit_evidence_collect — collect evidence when invoked |
| Tamper verification | delimit_evidence_verify — confirm a bundle hasn't been altered |
| Multi-model deliberation | delimit_deliberate — requires your own model CLI logins or API keys |
| Security audit | dependency scanning, secret detection, SAST |
| Test verification | confirms tests actually ran, measures coverage |
| Semantic memory search | delimit_memory_search — recall by meaning, across sessions and assistants |
Downstream artifacts you can build from attestations, on any tier:
npx delimit-cli trust-page -o ./trust # static public trust page from your attestations npx delimit-cli ai-sbom -o ./ai-sbom.json # CycloneDX-AI bill of materials
Activate
- Get a license key at delimit.ai/pricing
- Activate it:
npx delimit-cli activate <key>
3. Confirm:
npx delimit-cli status # shows license state alongside the rest of your setup npx delimit-cli doctor
For multi-model deliberation, use your own model CLI logins or API keys. Check available providers:
npx delimit-cli models
Honest scope
- Attestations prove what the gate checked and what the result was, pinned to exact content. They don't prove the code is correct — they prove the checks ran and what they found.
delimit attest mcpis a local preview of the methodology check, not a signed report.- Published Seal release receipts can be checked offline with
seal-verifywithout a license. Localwraprecords do not have hosted replay.