Your AI agent signs your commits. Does your project have a policy for that?¶
Ask Claude Code or Cursor to commit for you and, by default, the commit comes out stamped:
Whether that line belongs in your history is a policy question, and open source has already given three different answers.
| Position | Who takes it |
|---|---|
| No AI trailers in the history; disclose in the pull request instead | Kubernetes |
| AI is welcome, but say so with a trailer, and never credit the tool as a person | Linux kernel and Fedora (Assisted-by:) |
| The tool can be credited as a co-author | pytest (Co-authored-by:) and the ASF (Generated-by: or Co-authored-by:) |
The kernel adds one hard rule on top: an AI agent must never add a
Signed-off-by: line, because only a person can certify the
DCO.
The trouble is that all of these are policies written in contributor guidelines and enforced by a reviewer's eyes. Nobody reads trailers carefully on the twentieth pull request of the day.
Making the policy a check¶
Commit Check is open-source
commit policy as code for teams and AI agents: the rules for commit messages,
branch names, authors and sign-offs live in one config file and are enforced in
hooks, CI and pull requests. Since v2.18 it can
enforce each of those positions from cchk.toml:
With forbid, the stamped commit above fails:
CC013 ai-attribution check failed ==> Claude Code
AI attribution is forbidden in this project — detected: Claude Code
Suggest: This project does not accept AI attribution in commit messages. Remove the AI trailer lines and re-commit.
Docs: https://commit-check.com/rules/#cc013
With disclose, the same commit fails for a different reason, and the failure
tells you exactly what to write instead:
CC014 ai-disclosure check failed ==> Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
AI assistance is not disclosed with Assisted-by or Generated-by — detected: Claude Code
Suggest: Disclose the tool with "Assisted-by: Claude Opus 5"
Docs: https://commit-check.com/rules/#cc014
CC015 ai-co-author check failed ==> Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
An AI tool is credited as a co-author: Claude Code
Suggest: Use "Assisted-by: Claude Opus 5" in place of the co-author line
Docs: https://commit-check.com/rules/#cc015
A third rule, CC016, rejects a sign-off by the tool. Only a person can certify the DCO, so no list of accepted trailers makes that sign-off acceptable. Each of the three rules can be demoted to a warning on its own, so you can roll the policy out gently.
The third position takes one more line: list Co-authored-by in
ai_disclosure_trailers, and the
co-author line counts as the disclosure. CC016 still refuses the tool's
sign-off.
The detection covers co-author and sign-off lines that name Claude Code, GitHub Copilot, Codex, Gemini, Cursor, Devin, Aider, Windsurf, Tabby or a model, and vendor marks such as "Generated with Claude Code". It matches the tools' noreply addresses, so a human co-author who happens to be called Claude is left alone. CC013 keeps the current list.
The fix comes with the failure¶
With --format json, the failing checks carry the corrected message, so a
script or an agent can apply it without interpreting anything:
Since v2.18.3, --fix applies it for you. Give it
the message file, or give the pre-commit hook
args: [--fix],
and the co-author line is rewritten as the disclosure before the commit is
recorded:
$ commit-check -m --fix msg.txt
✎ fixed the commit message: CC014 ai-disclosure
$ cat msg.txt
fix: resolve race condition in the cache
Assisted-by: Claude Opus 5
That is also the point of the MCP server: the agent asks for your rules before it commits, and writes the disclosure your project wants in the first place.
Run it where it cannot be skipped¶
The same cchk.toml drives a pre-commit hook, a GitHub Action, a GitHub App
and a plain CLI for any other CI, so the policy a developer sees locally is the
one the pull request is checked against. Make that check required in the
branch's ruleset or branch protection, and a commit that fails it cannot be
merged. Where to run it walks through each
setup.
To try the disclosure policy without writing a config file:
pip install commit-check
printf 'fix: resolve race condition\n\nAssisted-by: Claude Opus 5\n' | CCHK_AI_ATTRIBUTION=disclose commit-check -m
What it cannot do¶
This checks disclosure, not authorship. It catches a commit that says it was AI-assisted; it cannot catch one that was AI-assisted and says nothing. Against a policy of "no AI contributions at all", it is an honesty check for contributors who already follow the rules, not a detector. For the far more common policy, "tell us when you used it, and in this format", it turns a paragraph in CONTRIBUTING into a check that runs on every commit.
The rules, with examples, are in the rules reference, and the policy guide walks through each setting.
Which of the three positions does your project take, and is it written down anywhere yet? Tell us in Discussions.