Squash violations, not velocity. The pytest of AI compliance. Runs in your CI/CD pipeline.
215
AI compliance as code. Squash violations, not velocity.
Squash is the compliance gate that lives in your CI pipeline. It attests every AI model you ship, generates cryptographically signed compliance artifacts, and integrates with every tool engineers already use — GitHub Actions, GitLab CI, Jenkins, ArgoCD, Terraform, MLflow, and more.
One docker run generates a signed EU AI Act Annex IV document, NIST AI RMF controls map, bias audit, hallucination rate certificate, SBOM, and CVE assessment for any model.
# Run the zero-install demo
docker run --rm ghcr.io/konjoai/squash:latest squash demo
# Attest a local model
docker run --rm \
-v $(pwd)/models:/models \
konjoai/squash:latest \
squash attest /models/my-model --policy eu-ai-act --sign
# Scan any HuggingFace model before downloading
docker run --rm konjoai/squash:latest \
squash scan hf://microsoft/phi-3-mini-4k-instruct
# Run the full API server
docker run -p 4444:4444 \
-e DATABASE_URL=your_postgres_url \
-e SECRET_KEY=your_secret_key \
konjoai/squash:latest
| Output | Standard |
|---|---|
| ML Software Bill of Materials | CycloneDX 1.7 |
| Source Bill of Materials | SPDX 2.3 |
| EU AI Act Annex IV document | EU AI Act 2024/1689 |
| Regulatory controls map | NIST AI RMF · ISO 42001 · FedRAMP |
| Bias audit certificate | NYC Local Law 144 · EU AI Act Annex III |
| Hallucination rate certificate | Domain-calibrated · Wilson CI |
| Supply chain provenance | SLSA · Sigstore · Ethereum anchor |
| CVE assessment | VEX · OSV |
| Signed attestation record | Ed25519 · att:// URI |
| Date | Regulation |
|---|---|
| Jun 30, 2026 | Colorado AI Act |
| Aug 2, 2026 | EU AI Act enforcement |
| Ongoing | SEC AI washing examinations |
| Ongoing | NYC Local Law 144 bias audits |
CI/CD: GitHub Actions · GitLab CI · Jenkins · CircleCI · Azure DevOps · ArgoCD · Flux
ML Platforms: MLflow · Weights & Biases · HuggingFace · SageMaker · Vertex AI · LangChain
Infrastructure: Terraform · Pulumi · Helm · Kubernetes
API Gateways: Kong · AWS API Gateway · FastAPI · Django
Observability: Prometheus · OpenTelemetry · Datadog · Honeycomb
Notifications: Slack · Teams · JIRA · Linear · GitHub Issues
| Tag | Description |
|---|---|
latest | Latest stable release |
2.7.0 | Current release — 85 modules, 5,290 tests |
main | Built on every push to main |
sha-xxxxxxx | Pinned by git SHA for reproducibility |
| Variable | Required | Description |
|---|---|---|
DATABASE_URL | API mode only | PostgreSQL connection string (Neon recommended) |
SECRET_KEY | API mode only | 32-byte hex secret for JWT signing |
SQUASH_API_TOKEN | Optional | Pre-configured API token |
SQUASH_LOG_LEVEL | Optional | INFO (default) · DEBUG · WARNING |
# All CLI commands work without DATABASE_URL or SECRET_KEY
docker run --rm -v $(pwd):/workspace konjoai/squash:latest \
squash attest /workspace/model --policy eu-ai-act
Apache 2.0 — free for individuals and open source. Commercial use: squash.works — from $499/month.
Content type
Image
Digest
sha256:64e7763b7…
Size
88.4 MB
Last updated
6 months ago
docker pull konjoai/squash