attest-mcp

Evidence attribution for code changes, as an MCP server.

Agents (and humans) waste their worst debugging hours on misattributed evidence:

• a suite shows 7 failures after an edit — and all 7 were already failing before it (cue 30 turns of "fixing" other people's bugs, or reverting a correct change)
• tests are green, so the change ships — but no test ever executed the changed lines; green was about everything else
• the fix "has no effect" — because src/ was edited and stale dist/ is running (cue 10 turns of debug prints that also never run)

verify-style tools answer whether checks pass. attest answers whether that pass/fail is actually evidence about your change.

Tools

attribute — which failures did my change cause?

Runs the checks in your working tree and compares against a baseline run at a known ref (default: merge-base with main). The baseline executes in a throwaway git worktree — your tree is never touched — and is cached by tree hash, so repeat calls are instant.

attribute
→ summary: 1 new · 0 fixed · 7 pre-existing (ignore)
  NEW failures (caused by your change):
    pytest:tests/test_pricing.py::test_discount — AssertionError: 10.8 == 12
  pre-existing (already failing at baseline — not yours): …

Call it the moment you see red output, before debugging anything.

diff_coverage — did any test actually run my changed lines?

Diffs the working tree against a base ref, runs the tests under coverage (Node via c8/V8 — no source instrumentation; Python via coverage.py), and intersects executed lines with the diff.

diff_coverage
→ verdict: UNTOUCHED
  src/recover.js: 0/18 changed lines executed — NOT executed: 41-58
  → changed lines that no test executes are unverified — add a test that reaches them

UNTOUCHED on a green suite is the classic false-victory tell.

freshness — is the artifact built from my sources?

Call it the moment an edit "has no effect", before adding debug prints. Prefers sourcemap content comparison (exact — immune to mtime churn from branch switches); falls back to mtime chains, clearly labeled as heuristic.

freshness target=dist/cli.js
→ STALE: dist/cli.js does NOT reflect current sources
  src/parser.ts: on-disk content differs from the sourcemap's embedded copy
  → rebuild first: npm run build

baseline — pre-warm or refresh the comparison point

attribute builds baselines lazily; call baseline explicitly to pre-warm one before starting an edit, or force=true to refresh a suspect cache entry.

How failures are identified

Runner-native identities where possible — pytest node ids, unittest module.Class.test, node:test / vitest / jest test names — with a normalized fingerprint fallback (paths debased, numbers stripped) for unknown runners, so even a make check diff usefully.

Install

// .mcp.json
{
  "mcpServers": {
    "attest": {
      "command": "npx",
      "args": ["-y", "@ahmedshaikh/attest-mcp"]
    }
  }
}

Baselines cache in ~/.attest/attest.db (override with ATTEST_DB). Project root defaults to the server cwd (ATTEST_ROOT or per-call cwd override).

Limits

• requires a git repository (baselines are git-ref-addressed)
• baseline worktrees symlink node_modules/.venv from the main checkout; repos whose checks need per-tree generated state may need cmd scoping
• test-command detection covers package.json test scripts and python test layouts; pass cmd explicitly for anything else
• Python coverage needs coverage.py installed in the interpreter under test
• per-test attribution ("which test touches line N") and flaky detection via baseline double-runs are v2

Development

npm install
npm test        # node:test; python tests need python3 (+ coverage.py for one test)
npm run build

MIT