Rework Proof MCP server

REWORK Proof Check

Reports who actually wrote the commits in a pull request — signature state, author attribution, and declared AI assistance — as a job summary.

By default it sends nothing anywhere. It reads the pull request's commits with the token your workflow already has and writes a summary. No account, no API key, no third-party access to your repository.

name: Proof
on: pull_request

jobs:
  proof:
    runs-on: ubuntu-latest
    steps:
      - uses: reworkio/REWORK-Proof@v1

That's the whole setup.

New here? GETTING-STARTED.md walks a fresh repository through both this action and the GitHub App — which to choose, what each one grants, and a set of commits that exercise every case so you can see what the report actually does before trusting it.

One-click setup

Replace OWNER/REPO with your own and open this — GitHub's editor opens with the workflow already written, and you just press Commit:

https://github.com/OWNER/REPO/new/main?filename=.github/workflows/proof.yml&value=name%3A%20Proof%0Aon%3A%20pull_request%0A%0Ajobs%3A%0A%20%20proof%3A%0A%20%20%20%20runs-on%3A%20ubuntu-latest%0A%20%20%20%20steps%3A%0A%20%20%20%20%20%20-%20uses%3A%20reworkio%2FREWORK-Proof%40v1%0A

If your default branch isn't main, change the /new/main segment to match.

What it reports

For every commit on the pull request:

is the pull request's author. A commit whose email never matched a GitHub account is not flagged; that's ordinary, and flagging it would make the check noise. Bot accounts (a [bot] suffix — dependabot, github-actions) are classed as automation, listed separately from human co-authors.

• Signature state — whether GitHub could cryptographically verify it.
• Author attribution — whether the account GitHub resolved the commit to

a Co-Authored-By: Claude (or Copilot, Codex, Gemini, Cursor, Devin, aider, …) trailer, a Claude-Session: or Amp-Thread-ID: trailer, or a Generated with line. The full list is src/ai-trailers.json, and the GitHub App check reads the same file, so a commit reads the same either way.

• Declared AI assistance — a commit message that names a coding assistant:

Declaring AI assistance does not lower the result. The author chose to say so, which is good practice; penalising the trailer would just teach people to delete it — which destroys the signal for the person who needed it.

"None declared" means none declared. The action reads commit messages. A message with no trailer looks the same whether or not a tool wrote the code, so a count of zero says nothing was declared, never that nothing was used.

Unsigned commits are not treated as a fault either. Most repositories never enable signing. The check reports what can be proven and says plainly what can't.

What the App records after a merge

The Action reports on one pull request and is finished. The GitHub App, which receives the pull request's closed event, also records the outcome:

Shortened. The full README is on GitHub.