Open protocol · Apache-2.0 · release 0.7.0

Make machine actions checkable.

Matrix Scroll creates signed records for the declared actor, tool, scope, and action. Reviewers can verify them offline in the CLI, browser, or CI.

SSX360 uses Matrix Scroll to package signed records for offline review.

Try the verifier Read the quickstart

GitHub PyPI SSX verification levels

0.7.0 current release 14 MCP tools Offline verification Apache-2.0 code

See it work

One command checks the complete range.

Install the pinned release, create signed records, then require the same verification in local review and CI.

pip install "matrixscroll==0.7.0"

SCROLL_GATE / RANGEPASS

$ matrixscroll envelope verify-range origin/main HEAD

range: 3 commits
envelopes: 3 present
signatures: 3 valid
gaps: 0 found

actor_typecitoolrelease-runneralgorithmed25519modehardware

Verification proves origin from the key holder and detects changes. It does not prove that the action was authorized.

Three workflows

Sign. Verify. Enforce.

The 14-tool MCP server remains part of release 0.7.0. The complete tool ledger and behavior are documented in the quickstart.

01 / SIGN

Create a record when the action happens.

Bind the declared actor, tool, scope, and action to an exact signed envelope.

matrixscroll hook installmatrixscroll envelope create

Read the signing quickstart →

02 / VERIFY

Check a record without trusting the issuer.

Use the CLI or browser verifier. The check runs offline and requires no Matrix Scroll account.

Open the verifier →

03 / ENFORCE

Fail the range when evidence is missing.

Scroll Gate walks the pull-request range and identifies every missing or invalid record before merge.

Configure Git and CI →

Finished SSX360 USB signer in a black enclosure with blue and amber status lighting — Product visualization. Physical units are supplied directly by SSX360.

Dedicated signer

The USB signer is finished and produced.

The private Ed25519 key remains inside the secure element. The device returns signatures to the same Matrix Scroll verifier used by the software signer.

Host packagematrixscroll[mcp,hardware]==0.7.0

MCP accessconnect_card

SupplyDirect through SSX360

Request a USB signer Hardware setup

Release 0.7.0

Available now.

Shipping now: PyPI 0.7.0, software signing, the 14-tool MCP server, Git hooks, Scroll Gate range checks, browser verification, MCP surface scanning, and USB signer host support.

Separate path: The physical signer is supplied through direct contact. PyPI distributes its host software.

Authorization boundary: Actor, tool, scope, and action are declared origin fields. A valid signature proves the record came from the key holder and was not changed; it does not establish that the action was approved.

Post-quantum overlay: ML-DSA and SLH-DSA run through liboqs. Treat this as an algorithm implementation. liboqs states that it should not protect sensitive production data.