Check your app against a standard

Run mainsdk assure against PCI DSS or another standard, see who owns each failure, gate merges in CI, open a pull request of mechanical fixes and keep signed evidence.

Planned for 0.7

Status Status is where the work is: Planned (in a milestone, not started), Building (tickets in progress), Preview (usable, may change), then the stability it ships at.

Stability The promise an interface ships with.

Stable Follows semantic versioning; breaking changes need a new major, 12 months of overlap and a codemod.
Beta Usable in production; may change before it becomes stable.
Experimental May change or go away; needs an explicit opt-in in main.yaml.

Stability levels

View as Markdown Open in Claude Edit

Updated 2026-10-28

You will find out where your app fails PCI DSS 4.0.1, see which team owns each failure and by when it is due, fail CI on new failures, and keep evidence an assessor can verify. It takes about 20 minutes. A pass is evidence, not a certification.

You need

A MainSDK app with industry: payments in main.yaml (see industry packs).
A CODEOWNERS file, or an owners map in main.yaml.

1. Run it

bash

npx mainsdk assure --standard pci-dss-4.0.1

Each failing control prints its owner, severity and deadline: critical 7 days, high 30, medium 90. Add --json for the same content as data, or --format sarif|cyclonedx|oscal|pdf for the other outputs.

2. Give failures an owner

main.yaml

owners: { "app/checkout/**": web-team }

CODEOWNERS is read first, then this map. A failure with neither is listed as unowned, so it never drops out of a report.

3. Record an exception

main.yaml

exceptions:
  - rule: pci-dss-4.0.1:10.5.1
    reason: Log store migration in progress
    approver: ravi@acme.dev
    expires: 2027-06-30

The control shows as excepted until the expiry date and fails again after it. Every exception is written into the evidence. An exception with no reason, approver or expiry stops the run with MAIN-ASSURE-0001.

4. Gate merges in CI

bash

npx mainsdk assure --standard pci-dss-4.0.1 --release v1.2   # on the release
npx mainsdk assure --standard pci-dss-4.0.1 --diff --fail-on high   # on every pull request

--diff shows only failures that are new since the last release, and the run exits 1 when one is at or above the level. This is free in your own CI.

5. Fix what a machine can fix

bash

npx mainsdk assure --standard pci-dss-4.0.1 --fix

One pull request changes settings such as logging.retention. Judgement calls, such as approving a script on a payment page, are listed and left to a person. Your agent can read the same two lists with the MCP tool assure.fix.

6. Keep and check the evidence

Every run writes .mainsdk/assure/latest.bundle, signed, with the results, SBOM, VEX, policy test results, restore drills and exceptions.

bash

npx mainsdk assure verify .mainsdk/assure/latest.bundle

Pin the signer's public key under seal.signers in main.yaml and it verifies as verified; any changed byte fails with MAIN-ASSURE-0004.

Check someone else's app

bash

npx mainsdk assure https://orders.example.dev

This reads the app's signed /.well-known/mainsdk.json and writes nothing. Only the controls the record can answer are judged; the rest are listed as not evaluated. A record whose signature fails exits 2 with MAIN-ASSURE-0003.

Was this page helpful?