Quill MCP server

notari

Notari issues a signed Change Passport for every AI-authored pull

request: a receipt any reviewer or auditor can re-verify from the signature

alone, without re-running Notari or trusting a screenshot, recording which

files a human approved the agent to touch and

whether it stayed inside them. A human signs the boundary once; in CI, Notari

checks each pull request against it and stamps the passport PASS,

NEEDSREVIEW, or BLOCK**. There is no model in that verdict, so it cannot

be prompt-injected. It does not judge whether the code is correct: it

attests to where the change went and whether it leaked a secret, the part a

human most often skims past on a large agent PR. Alpha; treat

the security model

as the source of truth over any one-line claim.

Start here: one command

uvx notari init

Nothing to install first. In one command, inside any git repo, that generates an approver keypair and a gate keypair, signs a secure-by-default perimeter, writes the hardened GitHub workflow (pullrequesttarget, SHA-pinned, the pull request checked out into a data-only directory), gitignores your private keys, and then prints your honest posture plus the exact steps still missing. Measured from a clean machine with no Python tooling configured, the CLI resolves and runs in about a second and a half.

Prefer a persistent install? pipx install notari or pip install notari, then notari init. Either way the next two commands are the whole daily loop:

notari begin "add rate limiting" --scope "src/api/**"    # sign what the agent may touch
notari verify --strict                                    # in CI: PASS, NEEDS_REVIEW, or BLOCK

notari init automatically forbids directories that look sensitive (auth,

migrations, infra, terraform, deploy, and similar). Forbidden beats contract

scope, so scoping a task into one of them returns BLOCK by design. When you really

do need to touch one, set the boundary explicitly and sign it:

notari guard --key approver.pem --allow "src/" --forbid "migrations/".

What you actually get

Four surfaces, each stated at its real strength rather than its most flattering one:

1. The gate, which is the provable boundary. In CI, outside the agent's reach, every changed path outside .notari/ is measured against a signed scope and a signed perimeter, each touched file is scanned for 26 vendor secret patterns, and renames (both endpoints), mode-only changes, binaries, symlinks, submodules, and .gitattributes diff-hiding are all in the inventory rather than blind spots. You name the scope per task (--scope), so a narrow scope means "only these paths", and the explicit --scope '**' means "anything the signed perimeter does not forbid", stated plainly on the passport either way so a PASS is never ambiguous. Secret detection is a finite pattern set, so it catches the common vendor-format leaks rather than proving no secret exists. There is no model in the decision path, so there is nothing to prompt-inject.

Shortened. The full README is on GitHub.