--- title: "testifysec" description: "TestifySec platform workflows for Pushgate, Cilock, Witness policies, jctl, attestation provenance and vulnerability remediation." canonical: https://agentpluginsdirectory.com/plugins/testifysec last-updated: 2026-09-21 --- # testifysec TestifySec platform workflows for Pushgate, Cilock, Witness policies, jctl, attestation provenance and vulnerability remediation. - Slug: testifysec - Publisher: TestifySec - Repository: https://github.com/testifysec/agent-plugins - Manifest: plugins/testifysec/plugin.json - Version: 0.1.1 - Category (editorial): other - Skills: 17 (attestation-metadata-parsers, cilock-test-tracing, creating-witness-policies, developing-attestors, embedded-archivista, managing-compliance-api, platform-vulnerability-inventory, policy-authoring-eval, policy-e2e-testing, releasing-cilock, syncing-rookery, testifysec-platform, traversing-attestation-graph, using-cilock, using-jctl, using-pushgate, verifying-attestors) - MCP servers: 0 - Stars: 0 - Repository created: 2026-09-18 - Repository last pushed: 2026-09-18 - Publisher type: Organization - Listing: https://agentpluginsdirectory.com/plugins/testifysec - Schema: https://agent-plugins.org/schemas/1.0.0/plugin.schema.json ## What testifysec does, in the publisher's words Portable workflows for the TestifySec platform: Pushgate, Cilock, Witness policy authoring and verification, jctl/MCP, attestor development, provenance, compliance, and vulnerability inventory/remediation. The public source marketplace consolidates the existing skill library. See the installation guide and review methodology. - plugin.json: Agent Plugins 1.0 portable manifest. - skills/*/SKILL.md: Agent Skills. - examples/mcp.json: optional portable MCP connection for jctl mcp --stdio. - codex-plugin/plugin.json: Codex compatibility packaging. - claude-plugin/plugin.json: Claude Code compatibility packaging. Skills and their resources have one canonical home here. Compatibility manifests share those files; there are no separate copies per client. The portable and compatibility MCP files must describe the same command/args and contain no secrets. Install jctl and cilock from the organization's approved distribution and put them on PATH. Source-development skills additionally require a Judge checkout and its supported jade, Go and OPA tools. Inspect installed command help before use; this package neither downloads executables nor supplies credentials. From the project README, punctuation lightly normalized. Full text: https://raw.githubusercontent.com/testifysec/agent-plugins/HEAD/plugins/testifysec/README.md ## Skills - attestation-metadata-parsers: Work with cilock/witness attestation metadata parsers. Use when adding new attestor types, modifying metadata extraction, or debugging attestation data. Activates for tasks mentioning attestation parser, metadata extractor, cilock attestor, witness attestor, aflock attestor, or attestation metadata. - cilock-test-tracing: Debug slow or side-effectful tests using local Cilock trace attestations. Use to inspect subprocesses, network activity, filesystem observations, and repeated work when improving test isolation, caching, or multi-worktree throughput. - creating-witness-policies: Author and verify Witness policies with Cilock: steps, functionaries, certificate and timestamp constraints, Rego, external evidence, cross-step artifacts and verification summaries. - developing-attestors: Create or modify rookery attestors (subtrees/rookery) and keep the catalog in sync. Use when adding/changing an attestor, editing conventions.go, adding a steampipe plugin convention, touching detector.yaml, or wiring a new attestor into cilock. Activates for tasks mentioning attestor, conventions.… - embedded-archivista: The bridge between Judge's tenant viewer and the embedded archivista fork in judge-api. Explains why archivista never reads a Judge viewer, how EmbeddedStore supplies the tenant, where AccessChecker is wired, and how to debug \"could not get judge viewer\". Use when uploading or reading DSSE envelo… - managing-compliance-api: Query or manage TestifySec compliance frameworks, controls and directives through the Judge GraphQL API. Use for this API, not generic policy authoring or unrelated compliance products. - platform-vulnerability-inventory: Read current TestifySec vulnerability scans with jctl, reconcile duplicate evidence and scanner severities, map findings to artifacts and build inputs, and plan or verify remediation across all severities. - policy-authoring-eval: Run, iterate, and add scenarios to the policy-authoring eval. Drives a real LLM (or stub) through MCP tools to author witness policies, scores per-scenario \u00d7 per-dimension binary matrix, loops until convergence. Use when the chat agent fails to author a passing policy, when a new failure mode… - policy-e2e-testing: Exercise Witness policy authoring and verification end to end against a local Judge development instance, including positive and negative decisions and their UI evidence. - releasing-cilock: Release, distribute, sign, and analytics-track the cilock CLI across cilock.dev, the platform, and the analytics hub. Use when cutting a cilock release, publishing binaries, editing the rookery release pipeline, working on cilock.dev distribution/download, wiring download or CLI telemetry analytics… - syncing-rookery: Two-way sync between the testifysec/judge monorepo subtree (subtrees/rookery) and the public aflock-ai/rookery repo. Use when porting cilock/attestor/policy changes (or AI code-review fixes) upstream to rookery, pulling upstream rookery changes down, or keeping the two trees from drifting. Activate… - testifysec-platform: Navigate TestifySec platform work across Pushgate, Cilock, Witness policy authoring, jctl, provenance, compliance and vulnerability scans. Use for cross-product tasks or choosing the correct platform workflow. - traversing-attestation-graph - using-cilock - using-jctl - using-pushgate - verifying-attestors Descriptions come from the frontmatter of each SKILL.md, punctuation lightly normalized.