Patch the Holes
in Your Software

Like darning a sock, but for code. Darnit audits your project against software engineering best practices, patches the gaps automatically, and proves the result with signed attestations.

62
controls in the bundled OpenSSF Baseline implementation
8
control categories, from access control to vulnerability management
3
maturity levels to grow through as your project matures
0
forks needed, compose your own posture in pure TOML
About

Compliance Tooling That Actually Closes the Gaps

Darnit is a pluggable framework for auditing projects against engineering best practices. It provides the infrastructure for running compliance audits, generating cryptographic attestations, and automating remediation, so conformance is something you run, not something you write in a spreadsheet.

Security is a key focus, but Darnit covers the full spectrum of software quality: security posture, testing practices, build reproducibility, project governance, and documentation standards. Pass logic is expressed in CEL, and plugins are signed and verified with Sigstore.

Darnit is AI-native, too: it ships an MCP server so agents can audit, remediate, and attest interactively. Built in the open by Kusari and contributors, under Apache-2.0.

OpenSSF Baseline

What Darnit Checks Out of the Box

The bundled OpenSSF Baseline implementation covers 62 controls across eight categories and three maturity levels.

OSPS-AC

Access Control

Branch protection, MFA, and least-privilege permissions on repos and CI.

OSPS-BR

Build & Release

Signed artifacts, pinned dependencies, and sane release processes.

OSPS-DO

Documentation

READMEs, changelogs, and support information users can rely on.

OSPS-GV

Governance

Maintainer documentation, contribution guidelines, and response expectations.

OSPS-LE

Legal

Licensing that is present, clear, and consistent across the project.

OSPS-QA

Quality

Code review requirements, CI/CD quality gates, and test coverage.

OSPS-SA

Security Architecture

Threat modeling and a secure-by-design posture for the codebase.

OSPS-VM

Vulnerability Management

Security policies, reporting channels, and timely response to findings.

The Baseline is only the first plugin: the repo already ships reproducibility checks and gittuf policy checks, and any standard can be implemented, or composed in pure TOML, as a Darnit plugin.

Install

From Source, in Four Lines

$ git clone https://github.com/kusari-oss/darnit
$ cd darnit
$ uv sync
$ uv run darnit audit /path/to/repo

Requires Python 3.11+ and uv. Packaged channels — PyPI, Homebrew, containers are on the way.

MCP

Bring Your AI Assistant

# expose Darnit to any MCP client
$ uv run darnit serve --framework openssf-baseline

Point Claude or any MCP-capable assistant, at the server to audit, remediate, and attest interactively. See the getting started guide for the full walkthrough.

Community

Get Involved

Issues, ideas, and pull requests are welcome — whether you're fixing a control, writing a plugin for a new standard, or improving the docs. Development happens in the open on GitHub.

Star on GitHub
Project

Built in the Open

Darnit is an Apache-2.0 licensed open source project by Kusari and contributors. Read the contributing guide, the governance model, and the security policy to get oriented.