Metadata-Version: 2.5
Name: certone-sdk
Version: 0.2.0
Summary: CertOne SDK — typed API client, certone-submit (confidential scan + verdict gate) and the run-at-source agent.
Project-URL: Homepage, https://certkor.ai
Author: Certkor AI
License: Proprietary
Keywords: ai-compliance,certification,ci,confidential-computing,eu-ai-act
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Developers
Classifier: License :: Other/Proprietary License
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: Software Development :: Quality Assurance
Classifier: Typing :: Typed
Requires-Python: >=3.10
Requires-Dist: requests>=2.31
Provides-Extra: agent
Requires-Dist: certone-engine>=0.1.0; extra == 'agent'
Provides-Extra: azure
Requires-Dist: azure-identity>=1.15; extra == 'azure'
Requires-Dist: azure-keyvault-secrets>=4.7; extra == 'azure'
Provides-Extra: dev
Requires-Dist: mypy>=1.11; extra == 'dev'
Requires-Dist: pytest>=8.0; extra == 'dev'
Requires-Dist: ruff>=0.6; extra == 'dev'
Description-Content-Type: text/markdown

# certone-sdk

The Python SDK and command-line tools for [CertOne](https://certkor.ai), Certkor's AI compliance
certification platform. Send an AI project for a confidential scan from any pipeline, notebook,
editor or device, gate on the verdict, and fetch the evidence and the attestation.

CertOne evaluates the project inside a hardware-attested trusted execution environment (AMD SEV-SNP
confidential VMs, or Kata confidential containers): it builds the AI bill of materials, checks it
against the policy packs for the regions where the system runs (EU AI Act, NIST AI RMF, ISO/IEC
42001, sector rules...), runs dynamic tests and computes the evaluation metrics.

You need a CertOne tenant and an API key (Developer Hub -> API keys, `member` role).

## Install

```bash
pip install certone-sdk
```

Python 3.10+. Extras: `certone-sdk[azure]` reads the API key from Azure Key Vault with the compute's
managed identity.

## Command line: `certone-submit`

One command for any CI/CD system. It packs the project, submits it for a confidential scan, shows
progress until the verdict, and exits `0` on pass, `1` on fail, `2` on error -- so the job stops on a
failing certification.

```bash
export CERTONE_API_KEY=ck_...            # a tenant member key
certone-submit --project . --asset "Fraud Scorer" --country-code EU --environment ci
```

| option | |
|---|---|
| `--asset` | AI system name in CertOne (required) |
| `--country-code` | region the system operates in, e.g. `EU`, `US`, `CA` |
| `--environment` | `ci`, `jupyter`, `vscode`, `edge`, `api`, `cloud`, `cli` |
| `--tee` | `amd_sev_snp` (default) or `kata_cc` |
| `--fail-on` | lowest severity that fails the gate: `low`, `medium`, `high` (default), `none` |
| `--api` | platform URL (default `$CERTONE_API_URL`, else `https://platform.certkor.ai`) |
| `--api-key-vault` | read the key from `https://<vault>.vault.azure.net/secrets/<name>` |
| `--report-out`, `--attestation-out`, `--markdown-out` | write the report, the attestation (passing verdicts) or a markdown summary (e.g. `$GITHUB_STEP_SUMMARY`) |

## Python

```python
import os
from certone_sdk import CertOneClient, ProgressPrinter, submit_and_wait

client = CertOneClient("https://platform.certkor.ai", os.environ["CERTONE_API_KEY"])
sub = submit_and_wait(client, "rag-service", asset="RAG Answering Service", tee="kata_cc",
                      country_code="EU", on_progress=ProgressPrinter())
print(sub.verdict, sub.report["by_severity"])
for issue in sub.document["issues"]:
    print(issue["severity"], issue["description"])
if sub.passed:
    print(sub.attestation["attestation_id"])
```

The client also covers the rest of the API: `list_systems()`, `observability_summary()`,
`get_run()` (where the scan executed and the TEE's hardware attestation), `get_report_document()`,
`get_attestation()`.

## Agent: `certone-agent`

For devices and long-running services: keep certifying a project as it changes.

```bash
# re-scan confidentially whenever the project's content changes
certone-agent watch --mode confidential --project /opt/model --asset "Line Robot Picker" \
  --api https://platform.certkor.ai --environment edge --country-code EU --interval 600
```

`--mode local` runs the evaluation where the code lives and submits only the results (needs the
CertOne engine, `certone-sdk[agent]`, available to CertOne customers). `certone-agent deliver`
uploads a result signed inside an air-gapped network (`certone result sign`); the platform verifies
it against the source keys registered for the tenant.

## Licence

Proprietary. Use requires a CertOne subscription; see https://certkor.ai.
