CLI reference¶

The manifest command is installed with the cli extra.

pip install "agent-manifest[cli]"

Every command is invoked directly: manifest verify signed.json. Releases up to 0.5.0 nested them under a second manifest group; that spelling still works and prints a deprecation warning.

Commands¶

manifest create¶

Create a draft manifest from a JSON config file.

Usage: manifest create [OPTIONS] CONFIG

  Create a draft manifest from a JSON config file.

  CONFIG must be a JSON file with at minimum: agent_id, issuer, issued_at, expires_at,
  and an artifacts block.

  Example:
    manifest create config.json -o draft.json

Options:
  -o, --output TEXT  Write output to file (default: stdout)
  --help             Show this message and exit.

manifest sign¶

Sign a draft manifest with Ed25519.

Usage: manifest sign [OPTIONS] MANIFEST_FILE

  Sign a draft manifest with Ed25519.

  KEY must be a file containing the 64-hex-character (32-byte) Ed25519 private key seed.

  Example:
    manifest sign draft.json --key private.hex -o signed.json

Options:
  -k, --key TEXT     Path to raw 32-byte Ed25519 private key (hex file)  [required]
  -o, --output TEXT  Write output to file (default: stdout)
  --help             Show this message and exit.

manifest keygen¶

Generate a new Ed25519 key pair for manifest signing.

Usage: manifest keygen [OPTIONS]

  Generate a new Ed25519 key pair for manifest signing.

  Writes:
    private.hex - 64-hex private key seed (keep secret, mode 0600)
    public.hex  - 64-hex public key bytes

  Example:
    manifest keygen -d ./keys/

Options:
  -d, --output-dir TEXT  Directory to write key files
  --help                 Show this message and exit.

manifest attest¶

Extend the manifest hash into hardware and append the attestation block.

Usage: manifest attest [OPTIONS] MANIFEST_FILE

  Extend the manifest hash into hardware and append the attestation block.

  For TPM: requires tpm2-tools (apt-get install tpm2-tools). For swtpm in CI: set
  TPM2TOOLS_TCTI=swtpm: before running.

  Example:
    manifest attest signed.json --provider tpm --level 1 -o attested.json

Options:
  -p, --provider [auto|azure-cvm|tpm|sev-snp|tdx|opaque|software]
                                  Attestation provider (default: auto)
  --level INTEGER                 Minimum conformance level (0-3)
  -o, --output TEXT               Write output to file (default: stdout)
  --help                          Show this message and exit.

manifest verify¶

Verify a manifest against the local verification engine.

Usage: manifest verify [OPTIONS] MANIFEST_FILE

  Verify a manifest against the local verification engine.

  Prints the VerificationResult as JSON. Exits with code 0 on VALID, 1 on any other
  result.

  Use --crl-path to load a revocation list and check for revoked manifests.

  Example:
    manifest verify attested.json --crl-path revocations.jsonl

Options:
  --enforce-hitl         Fail unless a required HITL approval is present and unexpired
  --enforce-attestation  Fail unless the attestation report matches the manifest hash
  --crl-path TEXT        Path to a FileCRL JSON-Lines file for revocation checks
  --public-key TEXT      Path to a trusted raw Ed25519 public key hex file
  -o, --output TEXT      Write output to file (default: stdout)
  --help                 Show this message and exit.

manifest revoke¶

Generate a revocation record for a manifest ID.

Usage: manifest revoke [OPTIONS] MANIFEST_ID

  Generate a revocation record for a manifest ID.

  The record JSON can be submitted to your revocation registry or passed to a
  RevocationStore instance in the verification endpoint.

  Example:
    manifest revoke 018f4a3b-... --reason "key compromise" --revoked-by [email protected]

Options:
  -r, --reason TEXT  Reason for revocation  [required]
  --revoked-by TEXT  Identity of revoking authority (DID or email)  [required]
  -o, --output TEXT  Write output to file (default: stdout)
  --help             Show this message and exit.

Source¶

cli ¶

Agent Manifest CLI — issue #15.

Commands

manifest create Build a draft manifest from a config file manifest sign Sign a draft manifest with Ed25519 (or hybrid) manifest attest Extend manifest hash into hardware + append attestation block manifest verify Call the verification endpoint and print the result manifest revoke Publish a revocation record

All commands write JSON to stdout and accept --output/-o to write to a file.

cli ¶

cli() -> None

Agent Manifest SDK CLI.

create ¶

create(config: str, output: Optional[str]) -> None

Create a draft manifest from a JSON config file.

CONFIG must be a JSON file with at minimum: agent_id, issuer, issued_at, expires_at, and an artifacts block.

Example: manifest create config.json -o draft.json

sign ¶

sign(manifest_file: str, key: str, output: Optional[str]) -> None

Sign a draft manifest with Ed25519.

KEY must be a file containing the 64-hex-character (32-byte) Ed25519 private key seed.

Example: manifest sign draft.json --key private.hex -o signed.json

keygen ¶

keygen(output_dir: str) -> None

Generate a new Ed25519 key pair for manifest signing.

Writes: private.hex - 64-hex private key seed (keep secret, mode 0600) public.hex - 64-hex public key bytes

Example: manifest keygen -d ./keys/

attest ¶

attest(manifest_file: str, provider: str, level: int, output: Optional[str]) -> None

Extend the manifest hash into hardware and append the attestation block.

For TPM: requires tpm2-tools (apt-get install tpm2-tools). For swtpm in CI: set TPM2TOOLS_TCTI=swtpm: before running.

Example: manifest attest signed.json --provider tpm --level 1 -o attested.json

verify ¶

verify(manifest_file: str, enforce_hitl: bool, enforce_attestation: bool, crl_path: Optional[str], public_key: Optional[str], output: Optional[str]) -> None

Verify a manifest against the local verification engine.

Prints the VerificationResult as JSON. Exits with code 0 on VALID, 1 on any other result.

Use --crl-path to load a revocation list and check for revoked manifests.

Example: manifest verify attested.json --crl-path revocations.jsonl

revoke ¶

revoke(manifest_id: str, reason: str, revoked_by: str, output: Optional[str]) -> None

Generate a revocation record for a manifest ID.

The record JSON can be submitted to your revocation registry or passed to a RevocationStore instance in the verification endpoint.

Example: manifest revoke 018f4a3b-... --reason "key compromise" --revoked-by [email protected]

manifest_alias ¶

manifest_alias() -> None

Deprecated: every command is available at the top level.

Releases up to 0.5.0 nested the commands under a redundant manifest group, so the real invocation was manifest manifest verify while every document said manifest verify. The documented form is now the real one. This alias keeps the old spelling working for existing scripts.