# In-Toto

**Canonical:** https://apis.io/providers/in-toto/  
**Website:** https://in-toto.io  
**APIs profiled:** 4

in-toto is a CNCF graduated framework for securing the integrity of software supply chains. It provides a specification for generating and verifying metadata about each step in a software supply chain, from source code to deployment. in-toto ensures that each step is performed by the authorized party and that materials and products are not tampered with between steps.

## Kin Score — 27.6 / 100 (thin)

Scored 2026-08-20 under rubric 0.12.0. Trend: flat (+0.0 from 27.6).

| Facet | Score |
|---|---|
| Discoverability | 72.2 |
| Contract Quality | 29.6 |
| Governance | 9.8 |
| Contract Governance | 9.8 |
| Operational Transparency | 26.3 |
| Developer Ergonomics | 26.2 |
| Commercial Clarity | 15.8 |
| Access Clarity | 15.8 |

## Agent readiness — 3.0 (human-only)

| Dimension | Value |
|---|---|
| Spec Presence | no |
| Agentic Access | no |
| Reversibility Documented | no |
| MCP Server | no |
| Auth Clarity | no |
| Idempotency | no |
| Error Semantics | no |
| OpenAPI Examples | no |
| Rate Limit Signal | documented |
| Event Surface Described | no |
| Agent Skills | no |
| Well Known Catalog | no |
| Consent Identity | no |
| Agent Card | no |
| Dry Run Mode | no |

## Access

Freemium — onboarding: unknown, pricing: freemium, trial: no (confidence: medium).

## APIs (4)

- **in-toto Attestation Specification** — The in-toto specification defines the metadata format for recording software supply chain steps. It includes layout metadata that defines the expected steps and their authorized...
- **in-toto Attestation Framework** — The in-toto Attestation Framework provides a specification for generating verifiable claims about any aspect of how a piece of software is produced. It defines a fixed lightweig...
- **in-toto Python Reference Implementation** — The Python reference implementation of in-toto provides tools and libraries for creating and verifying in-toto metadata. It includes the in-toto-run command for wrapping supply ...
- **in-toto Go Implementation** — A Go implementation of the in-toto specification that enables supply chain integrity verification in Go-based build and deployment pipelines. It provides the same core functiona...

## Security (1)

- **In Toto Domain Security** — TLSv1.3 · HSTS

## Plans (1)

- **In Toto Plans Pricing**

## Tags

Cloud-Native, Graduated, Security, Software Integrity, Supply Chain Security, Verification

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/providers/in-toto/). Scores are computed from the provider's own public artifacts under a published rubric.