AgentPMT

GitHub Repository Code Signing and Attestation with Post-Quantum Cryptography

Saves ~20 min

Details

Automate post-quantum code signing and software supply chain attestation for GitHub repositories and release artifacts. This workflow asks the user which GitHub repository, branch, tag, or specific file they want to certify, downloads the content using the GitHub Repo Browser tool, and signs it with the Quantum-Safe File Attestation tool using ML-DSA-65 (Dilithium3) post-quantum digital signatures via hardware security module. Returns a verifiable attestation package containing a cryptographic manifest, digital signature, and verification bundle with a downloadable certificate link. Use cases include software release signing, open source distribution integrity, SBOM attestation, build artifact certification, code audit compliance evidence, CI/CD pipeline integrity verification, regulatory submission of source code, DevSecOps supply chain security, and tamper-proof repository snapshots for legal or IP protection.

Tools In This Workflow

Workflow Steps

  1. 1Gather Repository Details
  2. 2Download from GitHub
  3. 3Prepare Attestation Input
  4. 4Create Quantum-Safe Attestation
  5. 5Deliver Certificate to User
Step 1 of 5
Prompt1

Gather Repository Details

No prompt text was added.

Frequently Asked Questions

How do I connect this workflow to my local agent like OpenClaw or Claude Code?

You can install the local MCP server by opening a terminal and running:

Install commands

npm install -g @agentpmt/mcp-router
agentpmt-setup

This will connect you to local agents like Claude Code, Windsurf, Grok Build, Cursor, etc.

Alternatively you can connect to the hosted version with this config block, no installation required:

Hosted MCP config

{
  "mcpServers": {
    "agentpmt": {
      "type": "streamable-http",
      "url": "https://api.agentpmt.com/mcp",
      "headers": {
        "Authorization": "Bearer <AGENTPMT_BEARER_TOKEN>",
        "x-instance-metadata": "{\"client\":\"generic-mcp\",\"platform\":\"remote\"}"
      }
    }
  }
}

View MCP Connection Instructions for more details.

How do I trigger this workflow?

You can use it here in the browser by clicking the 'Try It' button.

If you 'star' the workflow it will save to your dashboard for quick access.

To use the workflow in an external agent, make sure you have followed the steps to connect it to the MCP server and then copy / paste this prompt, or just tell it to use the AgentPMT MCP server and use this workflow.

Agent prompt

Call the AgentPMT-Workflow-Skills tool with action 'get_workflow_skill' and skill_id 69c9e9c394c1eacb907d4150 ("GitHub Repository Code Signing and Attestation with Post-Quantum Cryptography").

Looking for help integrating AI into your business? Set up a free consultation.