MadeBy

MadeBy · honest credit in the age of AI

Who made this code?

AI writes more of the world's software every day, and the honest answer to who wrote this? is slipping away. MadeBy makes it answerable again — recording who authored each change, human, with AI, or AI, right on the commit. It never guesses whether code is AI; it records what the author puts on the record. Disclosure, not detection.

Try it in your repo ↓ Read the standard

Try it · about five minutes

Put your repo's authorship on the record

Open a terminal in any git repo. Everything runs locally with npx against your own history — no account, no keys, nothing hosted, and your code never leaves your machine. Each step shows a piece of how MadeBy works.

  1. See where you stand

    $ npx madeby coverage

    MadeBy reads what your commits already say about who wrote them — the trailers AI tools leave, DCO sign-offs, signatures — and scores how much of your history is on the record.

    Notice what it doesn't do: an undisclosed commit is unknown, never assumed human and never "detected" as AI. MadeBy only records what an author puts on the record.

  2. Disclose your last commit

    Every change is one of three categories in ACO, the open standard MadeBy runs on. Pick the one that's true for the commit you just made — each command adds one plain git trailer to HEAD:

    human

    You wrote it, no AI.

    $ npx madeby meAuthored-by-human: Dana Lee
    with_ai

    You wrote it, with AI help.

    $ npx madeby me --with-ai CursorAuthored-by-human: Dana Lee
    Assisted-by: Cursor
    ai

    An AI wrote it; you're still accountable.

    $ npx madeby ai "Claude Code"Authored-by-ai: Claude Code

    Run coverage again and that commit moves from unknown to known. It's just git — you could type the trailer yourself.

  3. Let your agents disclose for you

    $ npx madeby init

    Sets the repo up in one step: an AGENTS.md rule describing the convention (merged into yours if you have one), an advisory .madeby/policy.json, and — on GitHub — a pull-request check. Commit the files.

    Coding agents read AGENTS.md. With the rule present, Claude Code, Copilot and Cursor disclosed their own authorship in 12 of 12 trials — without being asked.

  4. Gate pull requests when you're ready

    The check init added runs madeby check on every pull request. It starts advisory: it reports which commits disclose their origin and never fails a build. When you want disclosure to be required:

    $ npx madeby init --required

    That switches .madeby/policy.json to "mode": "required" — the one line you could also edit by hand.

    Undisclosed commits now fail the check, and the output tells the contributor how to disclose them. MadeBy never blocks a PR on its own error, and never enforces a stricter rule than the one you wrote.

On GitLab, Azure DevOps or another CI? The same check is one line — npx madeby check <range> — and there are ready-made templates. Want an agent to run all of this? npx madeby mcp exposes it as MCP tools.

Reproducible result

Agents disclose on their own

100%
disclosed · 12 of 12 trials · convention present
0%
disclosed · 0 of 14 trials · no convention

Given an ordinary coding task with no mention of disclosure, three AI coding agents read an ACO convention file in the repo and disclosed their authorship — unprompted.

Claude CodeGitHub CopilotCursor

Every time the convention was present. Never without it. The experiment — fixtures, task, and scorer — is public, so you can run it yourself.

Run the experiment →

Why you can trust it

Built to be believed

Disclosure, not detection

ACO never accuses code of being AI — no tool can do that honestly, and false accusations are worse than the problem. It records only what an author chooses to put on the record.

An AI is not a co-author

A tool isn't a contributor. ACO uses a plain disclosure trailer — never Co-authored-by for AI — so it never implies AI authorship or clutters your contributor graph.

Open and reproducible

An open standard, MIT-licensed. Read the spec, run the experiment, verify every claim yourself. No account, no service, nothing hosted — it runs against your local git history.

Rides what already exists

Recognizes DCO sign-offs, SPDX AI-disclosure tags, and existing trailers rather than replacing them — and composes with Sigstore / SLSA for signed, high-assurance provenance.