Skip to main content
Web Summit, booth A6-13. Meet the founder on Wednesday 11 November.Book time
Reply IntelligenceGroup

Make AI agents prove what they checked.

Slipmark binds every AI agent verdict to a SHA-256 hash of the exact files the agent read. Before anything ships, the gate re-hashes them and refuses if anything changed.

It is live and open source. Set it up with one command. It runs as a GitHub Action. Formerly DriftGuard.

View on GitHubGitHub Marketplace

Attestation record

Re-hash before ship

  1. Files unchanged since approval

    Approved
    sha256 3a7f 09c2 e41b … c91e
    Before ship
    sha256 3a7f 09c2 e41b … c91e

    In registerHashes match. It ships.

  2. A file changed after approval

    Approved
    sha256 3a7f 09c2 e41b … c91e
    Before ship
    sha256 8d02 71fa 3c6e … b4a7

    RefusedOut of register. Nothing ships.

The verdict is bound to a SHA-256 hash of the exact files the agent read.

Illustrative record. Hashes are examples, not from a real run.
Status
Open source
Version
v0.6.2
Released
2 November 2026
Licence
Apache-2.0

Set it up in one command.

Run this in your repository. It adds a report-only GitHub workflow and instructions for your coding agents. Options are in the README on GitHub.

Read the README on GitHub
Terminal
npx slipmark init

Claude Code plugin

Using Claude Code? Run these two commands inside it to add the plugin.

Claude Code
/plugin marketplace add founder-ship-it/Slipmark
/plugin install slipmark@slipmark

Or add the GitHub Action yourself.

Prefer to edit a workflow by hand? Add this step to a GitHub Actions workflow instead.

GitHub Actions workflow step
- uses: founder-ship-it/Slipmark@v0.6.2

The agent asserts. You trust.

Autonomous agents produce clearance verdicts. Security audits, QA passes, review approvals. Nothing binds a verdict to what was actually inspected.

That works until it does not, and when it fails it fails silently, because a broken control still reports success.

A gate that reported green for months.

Our own nightly pipeline runs 20+ autonomous agents that research, architect, audit, build and QA production code.

One security audit gate had been inspecting the wrong branch since 20 May. It reported green for months. It could not fail.

No monitoring would have caught it. The control was working correctly. It was just working on the wrong thing.

What happened when we turned it on

Internal

23/23

Pointed at 23 open agent pull requests, it refused all 23.

RefusedInternal figure, from our own agent pipeline.

Attestation is bound to an artifact rather than asserted by the agent.

  1. 01

    Record

    The agent's verdict is bound to a SHA-256 hash of the exact files it read.

  2. 02

    Re-hash

    Before anything ships, the gate re-hashes those files.

  3. 03

    Refuse

    If anything changed, it refuses. Nothing ships against a stale verdict.

  4. 04

    Behavioural locks

    Slipmark's drift diagnosis lets you codify behavioural locks. In ReplyOS we use it to lock tenant isolation, enquiry capture and email threading.

Where it sits.

Controls define what an AI is allowed to do. Slipmark checks that what an agent approved is still what ships after someone changes the software.

A permission that stops applying after the next pull request is not much of a control. A gate that refuses on mismatch is what keeps it in force. It does not prove an agent behaves correctly. It detects when what was approved is no longer what ships.

AI controls, testing and oversight

What's new

Every release

v0.6.2

Fixes from the independent review of v0.5. None of them let a change through the gate.

Security

  • An attestation can only be written inside the repository, as a .json file, and never over a file that isn't an attestation. An agent talked into passing --out package.json now gets an error, not a damaged file.

Fixed

  • On a pull request, a coverage base that is the pull request's own commit now stops the run instead of quietly covering nothing.
  • A note followed straight by another option is treated as a missing note, not recorded as the option's name.

Changed

  • When a folder's own policy replaces the repository's root policy, the report now says so.

See it work: five attacks on coding agents' instructions, each an open pull request that Slipmark refuses. Open the demo repository

Why it is called Slipmark

A slip mark is the paint line engineers draw across a bolt once it has been tightened and checked.

If the bolt moves, the line breaks.

Status

  • 01Live and open source under the Apache-2.0 licence.
  • 02Version v0.6.2, released 2 November 2026.
  • 03Set up with one command: npx slipmark init.
  • 04Runs as a GitHub Action, with a Claude Code plugin and an MCP server for Codex, Cursor, Copilot and Gemini.
  • 05Slipmark Cloud, the hosted layer, is live at app.slipmark.dev.
  • 06Running in production inside our own ReplyOS pipeline.

Slipmark Cloud

The gate stays free and open source everywhere, including private repositories. Slipmark Cloud is the hosted layer for teams that need a record they can show someone else. It is free for public repositories.

  • An append-only record of every run, published daily to Sigstore's public log, so nobody can quietly rewrite it.
  • Every verdict checked again against GitHub's own copy of the code, not just what CI reported.
  • Rules such as "payments code needs a security review", enforced as a required GitHub check. Overrides need a written reason.
  • Alerts that say how to fix a failure, in Slack, Microsoft Teams, Discord, Google Chat, PagerDuty or email.
  • Evidence packs for SOC 2 and ISO 27001 change management, with read-only, expiring access for your auditor.
  • Free£0 public repositories
  • Team£15 per seat a month, minimum 3 seats
  • Business£40 per seat a month, minimum 10 seats

Team and Business come with a 14-day free trial. Enterprise contracts by invoice or purchase order.

Open Slipmark CloudSecurity and trust

Questions

Is Slipmark free?

Yes. The gate, the CLI and the GitHub Action are open source under Apache-2.0 and free in any repository, public or private, with no account. Slipmark Cloud, the hosted layer, is free for public repositories and from £15 per seat a month for private ones.

Does Slipmark call an AI model?

No. It compares SHA-256 hashes of files, so it is fast, costs nothing to run and gives the same answer every time.

Does Slipmark store our code?

No. CI sends only file paths, hashes, agent names and verdicts. To re-check a run, Slipmark Cloud reads files from GitHub's copy of the commit, hashes them in memory and keeps only the hashes. Data is held in London.

Does Slipmark prove an agent's review was right?

No. It proves which exact files a verdict was about, refuses when they have changed, and enforces which reviews are required. Whether the review was good is still down to the agent.

Who makes Slipmark?

Reply Intelligence Group Ltd, a UK AI implementation and software company in Watford, company number 17040048. We built it after a security gate in our own agent pipeline reported green for months while checking the wrong branch.

Bind the verdict to what was checked.

View on GitHubSlipmark CloudGitHub Marketplace