SDK quickstart

Install, sign, and verify.

Set up Matrix Scroll 0.7.0, add Git hooks, and verify signed records locally or in CI.

installv0.7.0

pip install "matrixscroll==0.7.0"
matrixscroll hook-install
matrixscroll hook-status

automated commitpost-commit hook

export MATRIXSCROLL_ACTOR_TYPE=ci
export MATRIXSCROLL_TOOL=release-runner
git commit -m "feat: automate release"
matrixscroll envelope-verify "$(git rev-parse HEAD)"

CI gatev0.7.0

- uses: SSX360/matrixscroll/.github/actions/verify@action-v1
  with:
    matrixscroll-version: "0.7.0"
    require-mode: emulated

MCP installv0.7.0

pip install "matrixscroll[mcp]==0.7.0"
{
  "mcpServers": {
    "matrixscroll-mcp": {
      "command": "matrixscroll-mcp"
    }
  }
}

USB signerhost integration

pip install "matrixscroll[mcp,hardware]==0.7.0"
export MATRIXSCROLL_MODE=hardware
matrixscroll status
matrixscroll-mcp

14-tool MCP server. matrixscroll-mcp exposes tools for envelopes, action records, pull-request checks, Git notes, MCP surface manifests, execution traces, audit export, and the USB signer. Local operations require no API key.

Completed USB signer. SSX360 supplies physical units through direct contact. PyPI distributes the host integration only. Configuration details are provided to qualified customers.

Finished SSX360 USB signer in a black enclosure with blue and amber status lighting — The signer protects its private key in hardware and returns signatures that Matrix Scroll can verify offline.

Hooks default to warn mode; set "enforce": true in .git/matrixscroll/config.json to block failed signing. Public examples on this page pin 0.7.0. Source of truth: GitHub, SPEC.md, whitepaper.

Verification boundary

Software mode proves possession of the private signing key. Hardware mode keeps the signing key isolated from the host. Neither mode establishes who was authorized to use the key, so trusted-key policy, workstation controls, physical access controls, and revocation remain the operator's responsibility. Matrix Scroll does not replace IAM, sandboxing, Sigstore, SLSA, or build attestations.

MCP tool ledger

Fourteen tools in release 0.7.0.

statusworkspace state

create_envelopecommit record

verify_envelopeoffline check

sign_actionaction record

verify_pr_rangerange check

publish_notesGit notes

audit_exportevidence bundle

list_envelopeshosted history

connect_cardsigner probe

scan_mcp_serversurface scan

sign_mcp_manifestsigned baseline

verify_mcp_manifestsurface compare

sign_agent_tracetrace record

verify_agent_tracetrace check

Prove it offline, then open the source.

Browser verifier MCP scanner Spec 5-minute guide Conformance vectors

Assessments and evidence mapping live at SSX360. Matrix Scroll stays free.