attestd

Attestd is a security API that provides deterministic risk signals for software components, addressing the problem of ambiguous vulnerability data that autonomous systems cannot act on. It serves developers, operations, and IT teams in organizations of all sizes, particularly those using CI/CD pipelines, infrastructure automation, and AI agents. The service is delivered as a cloud API with a free tier, offering three independent signals: CVE risk classification, supply chain compromise status, and package name integrity (typosquat detection).

Key features

• CVE risk classification (critical, high, elevated, low, none)
• Supply chain compromise status
• Package name integrity (typosquat detection)
• Deterministic signals (same version returns same result)
• Worst-case aggregation for multiple CVE ranges
• Continuous ingestion from NVD, CISA KEV, vendor advisories
• Webhooks for supply chain compromise alerts
• Coverage for 356 infrastructure products
• Supply chain monitoring for PyPI and npm packages