> The Markdown version of https://madeby.fyi/. Agents: start at https://madeby.fyi/llms.txt, or read everything in one file at https://madeby.fyi/llms-full.txt.

ACO — the Authorship Certificate of Origin. An open standard for verifiable authorship disclosure of code: human, human-with-AI, or AI. Disclosure, not detection.

*MadeBy · authorship on the record*

# Who made this code?

More of the world's software is written with AI every day, and a commit no longer tells you who actually wrote it. **MadeBy** puts the answer on the commit: written by a person, by a person with AI, or by AI. It never guesses whether code is AI; it records what the author discloses. **Disclosure, not detection.**

- [Try it in your repo ↓](https://madeby.fyi/#try)
- [Read the standard](https://github.com/MadeByFYI/MadeBy/blob/main/ACO.md)

```text
$ git show --stat HEAD
commit 4f3a9c2
Author:  Wren Ito <wren@example.com>

    feat: add slugify + tests

    Authored-by-ai: Claude Code

 src/util.js      | 6 +-
 src/util.test.js | 20 ++++
```

*Try it · about five minutes*

## Put your repo's authorship on the record

Open a terminal in any git repo. Everything runs locally with `npx` against your own history — **no account, no keys, nothing hosted**, and your code never leaves your machine. Each step shows a piece of how MadeBy works.

### 1. See where you stand

```sh
npx madeby coverage
```

MadeBy reads what your commits already say about who wrote them — the trailers AI tools leave, DCO sign-offs, signatures — and scores how much of your history is **on the record**.

```text
authorship coverage — last 500 commits  (estimate · disclosure, not detection)
  known     62%  ████████████░░░░░░░░  disclosed — on the record
  unknown   38%  ███████░░░░░░░░░░░░░  no disclosure — origin unknown, never guessed

  of the 310 known:  human 41% · with_ai 38% · ai 21%
```

Notice what it doesn't do: an undisclosed commit is *unknown*, never assumed human and never "detected" as AI. MadeBy only records what an author puts on the record.

### 2. Disclose your last commit

Every change is one of three categories in **ACO**, the open standard MadeBy runs on. Pick the one that's true for the commit you just made — each command adds one plain git trailer to `HEAD`:

- **human**: You wrote it, no AI. Run `npx madeby me`, which adds `Authored-by-human: Wren Ito`.
- **with_ai**: You wrote it, with AI help. Run `npx madeby me --with-ai Cursor`, which adds `Authored-by-human: Wren Ito` + `Assisted-by: Cursor`.
- **ai**: An AI wrote it. Run `npx madeby ai "Claude Code"`, which adds `Authored-by-ai: Claude Code`.

Run `coverage` again and that commit moves from unknown to known. It's just git — you could type the trailer yourself.

### 3. Let your agents disclose for you

```sh
npx madeby init
```

Sets the repo up in one step: an `AGENTS.md` rule describing the convention (merged into yours if you have one), an advisory `.madeby/policy.json`, and — on GitHub — a pull-request check. Commit the files.

Coding agents read `AGENTS.md`. With the rule present, Claude Code, Copilot and Cursor disclosed their own authorship in [12 of 12 trials](https://madeby.fyi/#evidence) — without being asked.

### 4. Gate pull requests when you're ready

The check `init` added runs `madeby check` on every pull request. It starts **advisory**: it reports which commits disclose their origin and never fails a build. When you want disclosure to be required:

```sh
npx madeby init --required
```

That switches `.madeby/policy.json` to `"mode": "required"` — the one line you could also edit by hand.

Undisclosed commits now fail the check, and the output tells the contributor how to disclose them. MadeBy never blocks a PR on its own error, and never enforces a stricter rule than the one you wrote.

On GitLab, Azure DevOps or another CI? The same check is one line — `npx madeby check <range>` — and there are [ready-made templates](https://github.com/MadeByFYI/MadeBy/tree/main/packages/action#readme). Want an agent to run all of this? `npx madeby mcp` exposes it as [MCP tools](https://github.com/MadeByFYI/MadeBy/tree/main/packages/cli#agent-native--the-mcp-server).

*Reproducible result*

## Agents disclose on their own

- **100%** disclosed · 12 of 12 trials · convention present
- **0%** disclosed · 0 of 14 trials · no convention

Given an ordinary coding task with **no mention of disclosure**, three AI coding agents read an ACO convention file in the repo and disclosed their authorship — unprompted.

Agents: Claude Code, GitHub Copilot, Cursor

Every time the convention was present. Never without it. The experiment — fixtures, task, and scorer — is public, so you can run it yourself.

- [Run the experiment →](https://github.com/MadeByFYI/MadeBy/tree/main/experiments/aco-adoption)

*Why you can trust it*

## Built to be believed

### Disclosure, not detection

ACO never accuses code of being AI — no tool can do that honestly, and false accusations are worse than the problem. It records only what an author chooses to put on the record.

### An AI is not a co-author

A tool isn't a contributor. ACO uses a plain disclosure trailer — never `Co-authored-by` for AI — so it never implies AI authorship or clutters your contributor graph.

### Open and reproducible

An open standard, MIT-licensed. Read the spec, run the experiment, verify every claim yourself. No account, no service, nothing hosted — it runs against your local git history.

### Rides what already exists

Recognizes DCO sign-offs, SPDX AI-disclosure tags, and existing trailers rather than replacing them — and composes with Sigstore / SLSA for signed, high-assurance provenance.

---

Verifiable provenance for code — who authored each change, on the record. Built on ACO, the open Authorship Certificate of Origin standard. Disclosure, not detection.

### Standard

- [The ACO spec](https://github.com/MadeByFYI/MadeBy/blob/main/ACO.md)
- [AGENTS.md convention](https://github.com/MadeByFYI/MadeBy/blob/main/AGENTS.md)
- [Adoption experiment](https://github.com/MadeByFYI/MadeBy/tree/main/experiments/aco-adoption)

### Use it

- [madeby on npm](https://www.npmjs.com/package/madeby)
- [Source on GitHub](https://github.com/MadeByFYI/MadeBy)
- [MCP server](https://github.com/MadeByFYI/MadeBy/tree/main/packages/cli#agent-native--the-mcp-server)
- [For agents: llms.txt](https://madeby.fyi/llms.txt)

© 2026 MadeByFYI, Inc.

MIT · disclosure, not detection