Garl-Protocol

Garl Receipt Action — AI skill for Claude Code

AI community

Cryptographic verification for AI-authored code.

How to install Garl Receipt Action

This entry records only its repository, not the path inside it, so there is no exact command to give. Open Garl-Protocol/garl-receipt-action and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Garl Receipt Action does

Cryptographic verification for AI-authored code. ECDSA-signed receipts (secp256k1, RFC 6979 deterministic) for every AI commit in your PRs — Claude Code, Cursor, Copilot, Aider, Codex. UETA §10(b) replay log + ISO 42001 evidence. Receipt-batch Merkle roots anchored on Base mainnet.

Alternatives in AI

Osaurus — Own your AI. The native macOS harness for AI agents -- any model, persistent memory, autonomous execution, cry 5.1k ★
Metaharness — 🛠️ The meta-harness for AI agents — scaffold your own focused, branded agent harness with its own npx CLI, MC 616 ★
Sdd In Action — 规范驱动开发实战手册 · Claude Code / OpenCode 双路 · 配套 ai-knowledge-base 135 ★

README

GARL Receipt — GitHub Action

[!IMPORTANT] **Archived on 24 September 2026.** GARL is no longer maintained. The GARL API this action calls (api.garl.ai) no longer accepts receipts, so new runs will fail. Existing anchored receipts remain verifiable at [garl.ai/anchors](https://garl.ai/anchors). Main repository: [Garl-Protocol/garl](https://github.com/Garl-Protocol/garl).

**Cryptographic proof for every AI-generated commit.**

Signs every AI-authored commit in a pull request (Claude Code, Cursor, GitHub Copilot, Aider, Codex) with an ECDSA-secp256k1 signature on the open-source [GARL Protocol](https://garl.ai) ledger, and posts a sticky PR comment + neutral GitHub check with a shareable receipt URL for each commit.

Five lines of YAML. One repo secret. No diffs or source are ever uploaded — only metadata.

What reviewers see on a PR

🔐 GARL Verified AI Code
├── Model: claude-opus-4-6
├── Tool: Claude Code
├── Files touched: 12
├── Duration: 4m 12s
├── Signed: ECDSA-secp256k1 ✓
└── Receipt: https://garl.ai/r/a8f3c2d1

Plus a rolling sticky PR comment:

**3 of 5 commits** signed as AI-authored. Breakdown: 2 Claude Code, 1 GitHub Copilot

And an informational (neutral) GitHub check named `GARL Receipt`.

[Live receipt example →](https://garl.ai/r/6ff83db8)

Setup (5 lines of YAML)

Register a repo agent via the [`garl_register_agent`](https://garl.ai/docs#mcp-server) MCP tool or `curl`:
```
curl -sX POST https://api.garl.ai/api/v1/agents/auto-register \
  -H "Content-Type: application/json" \
  -d '{"name":"gh--","framework":"github-action"}'
```
Save the `api_key` from the response. (The `agent_id` is optional — the action resolves it from the key, so one secret is enough.)
Add one repository secret:
- GARL_API_KEY — the returned API key
Optionally also add `GARL_AGENT_ID` to skip the per-run key→agent lookup.
Add the workflow (`.github/workflows/garl-receipt.yml`):