> ## Documentation Index
> Fetch the complete documentation index at: https://docs.chainloop.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Integrations

## Overview

Operators can extend Chainloop functionality by setting up third-party integrations that operate on your attestation metadata and workflow events. Integrations can range from sending a Slack message, uploading the attestation to a storage backend or sending a Software Bill Of Materials (SBOMs) to a third-party service for analysis, for example.

<img src="https://mintcdn.com/chainloop/qP5Aepelxm7aUyXA/concepts/img/integrations-1.png?fit=max&auto=format&n=qP5Aepelxm7aUyXA&q=85&s=fe175402cf86aae19628ef21249876ba" alt="Integrations" width="1303" height="896" data-path="concepts/img/integrations-1.png" />

### Integration capabilities

Chainloop integrations provide the following capabilities:

* **Keyless Attestation** — Attest directly from CI/CD environments using OIDC tokens, with no API keys to manage.
* **Repository Integration** — Link source code repositories to Chainloop projects so attestations are scoped and validated per-repo.
* **Fan-Out** — Distribute attestations, SBOMs, and artifacts to external systems after a workflow run.
* **Notifications** — Send alerts about product updates, system status, and workflow events.
* **Chainloop Ask** — Power the [Ask Chainloop](/concepts/ask-chainloop) natural language assistant in the web UI and Slack.
* **Evidence AI Prompt** — Evaluate attestation evidence using AI-driven, natural-language policies. See the [LLM-driven policies guide](https://docs.chainloop.dev/guides/llm-policies) and the [LLM support reference](/reference/llm-support).

Below you can find the list of currently available integrations. If you can't find the integration you are looking for, feel free to reach out or [contribute your own!](https://github.com/chainloop-dev/chainloop)

## Integration providers

<CardGroup cols={2}>
  <Card title="GitHub" icon="github" href="#github">
    Keyless attestation, repository integration
  </Card>

  <Card title="GitLab" icon="gitlab" href="#gitlab">
    Keyless attestation, repository integration
  </Card>

  <Card title="Slack" icon="slack" href="#slack">
    Notifications, Chainloop Ask
  </Card>

  <Card title="Dependency Track" icon="shield-halved" href="#dependency-track">
    Fan-out (CycloneDX SBOMs)
  </Card>

  <Card title="Discord" icon="discord" href="#discord">
    Fan-out (attestation delivery)
  </Card>

  <Card title="OpenAI" icon="microchip-ai" href="#openai">
    Chainloop Ask, Evidence AI Prompt
  </Card>

  <Card title="Anthropic" icon="microchip-ai" href="#anthropic">
    Chainloop Ask, Evidence AI Prompt
  </Card>

  <Card title="GUAC" icon="arrow-right-arrow-left" href="#guac">
    Fan-out (attestation + SBOM export)
  </Card>

  <Card title="Webhook" icon="globe" href="#webhook">
    Fan-out (generic POST)
  </Card>

  <Card title="SMTP / Email" icon="envelope" href="#smtp--email">
    Fan-out, Notifications
  </Card>

  <Card title="Microsoft Teams" icon="message" href="#microsoft-teams">
    Notifications
  </Card>
</CardGroup>

***

### GitHub

| Capability                                                                                                                                                                                                                                                                        | Description                                                                                       |
| --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------- |
| **Keyless Attestation**                                                                                                                                                                                                                                                           | Attest from GitHub Actions using OIDC tokens — no API keys required.                              |
| **Repository Integration**                                                                                                                                                                                                                                                        | Enroll GitHub repositories and link them to Chainloop projects for scoped attestation validation. |
| GitHub integration leverages GitHub's native OIDC identity provider, enabling your CI pipelines to perform attestations without managing long-lived credentials. Repositories are enrolled in Chainloop and linked to projects, so only authorized repos can submit attestations. |                                                                                                   |

<Card title="GitHub keyless attestation guide" icon="arrow-right" href="/guides/github-keyless">
  Step-by-step setup for OIDC-based keyless attestations from GitHub Actions.
</Card>

### GitLab

| Capability                 | Description                                                                                       |
| -------------------------- | ------------------------------------------------------------------------------------------------- |
| **Keyless Attestation**    | Attest from GitLab CI runners using OIDC tokens — no API keys required.                           |
| **Repository Integration** | Enroll GitLab repositories and link them to Chainloop projects for scoped attestation validation. |

GitLab integration uses GitLab's OIDC tokens with a `chainloop` audience claim. Like GitHub, repositories are enrolled and linked to projects before attestations are accepted.

<Card title="GitLab keyless attestation guide" icon="arrow-right" href="/guides/gitlab-keyless">
  Step-by-step setup for OIDC-based keyless attestations from GitLab CI.
</Card>

### Slack

<Note>
  This feature is only available on Chainloop's platform [paid plans](https://chainloop.dev/pricing).
</Note>

| Capability        | Description                                                                                                                    |
| ----------------- | ------------------------------------------------------------------------------------------------------------------------------ |
| **Notifications** | Receive alerts about product updates, system status, and workflow events via Slack channels.                                   |
| **Chainloop Ask** | Query your supply chain data using natural language directly from Slack (requires an AI provider such as Anthropic or OpenAI). |

Slack can be configured as both a notification channel and a Chainloop Ask interface. Notifications are configured at the organization or product level. Chainloop Ask in Slack requires a registered [AI provider](#openai) to function.

<CardGroup cols={2}>
  <Card title="Notifications setup" icon="bell" href="/concepts/notifications">
    Configure Slack notification channels and preferences.
  </Card>

  <Card title="Ask Chainloop" icon="message" href="/concepts/ask-chainloop">
    Learn about the AI-powered assistant available in web and Slack.
  </Card>
</CardGroup>

### Dependency Track

| Capability  | Description                                                                                                                      |
| ----------- | -------------------------------------------------------------------------------------------------------------------------------- |
| **Fan-Out** | Automatically send CycloneDX SBOMs to your [Dependency-Track](https://dependencytrack.org/) instance for vulnerability analysis. |

This integration forwards SBOM materials collected during attestation to Dependency-Track, enabling continuous vulnerability monitoring of your software components.

Supported metadata: `SBOM_CYCLONEDX_JSON`

[View integration source](https://github.com/chainloop-dev/chainloop/blob/main/app/controlplane/plugins/core/dependency-track/v1/README.md)

### Discord

| Capability  | Description                                                  |
| ----------- | ------------------------------------------------------------ |
| **Fan-Out** | Send attestation summaries to Discord channels via webhooks. |

[View integration source](https://github.com/chainloop-dev/chainloop/blob/main/app/controlplane/plugins/core/discord-webhook/v1/README.md)

### OpenAI

<Note>
  This feature is only available on Chainloop's platform [paid plans](https://chainloop.dev/pricing).
</Note>

| Capability             | Description                                                                            |
| ---------------------- | -------------------------------------------------------------------------------------- |
| **Chainloop Ask**      | Powers the [Ask Chainloop](/concepts/ask-chainloop) assistant in the web UI and Slack. |
| **Evidence AI Prompt** | Evaluate attestation evidence using natural-language policies via OpenAI models.       |

Register OpenAI as an AI provider to enable Chainloop Ask across the web UI and Slack, and to use LLM-driven policy evaluations on attestation evidence.

<CardGroup cols={2}>
  <Card title="Ask Chainloop" icon="message" href="/concepts/ask-chainloop">
    Natural language assistant for supply chain queries.
  </Card>

  <Card title="LLM support reference" icon="book" href="/reference/llm-support">
    Configuration details for AI providers.
  </Card>
</CardGroup>

### Anthropic

<Note>
  This feature is only available on Chainloop's platform [paid plans](https://chainloop.dev/pricing).
</Note>

| Capability             | Description                                                                            |
| ---------------------- | -------------------------------------------------------------------------------------- |
| **Chainloop Ask**      | Powers the [Ask Chainloop](/concepts/ask-chainloop) assistant in the web UI and Slack. |
| **Evidence AI Prompt** | Evaluate attestation evidence using natural-language policies via Anthropic models.    |

Register Anthropic as an AI provider to enable Chainloop Ask across the web UI and Slack, and to use LLM-driven policy evaluations on attestation evidence.

<CardGroup cols={2}>
  <Card title="Ask Chainloop" icon="message" href="/concepts/ask-chainloop">
    Natural language assistant for supply chain queries.
  </Card>

  <Card title="LLM support reference" icon="book" href="/reference/llm-support">
    Configuration details for AI providers.
  </Card>
</CardGroup>

### GUAC

| Capability  | Description                                                                                                                        |
| ----------- | ---------------------------------------------------------------------------------------------------------------------------------- |
| **Fan-Out** | Export attestation and SBOM metadata to a blob storage backend for consumption by [guacsec/guac](https://github.com/guacsec/guac). |

Supported metadata: `SBOM_CYCLONEDX_JSON`, `SBOM_SPDX_JSON`

[View integration source](https://github.com/chainloop-dev/chainloop/blob/main/app/controlplane/plugins/core/guac/v1/README.md)

### Webhook

| Capability  | Description                                                                  |
| ----------- | ---------------------------------------------------------------------------- |
| **Fan-Out** | Send attestations and SBOMs to any HTTP endpoint via a generic POST webhook. |

A flexible integration for forwarding attestation data to any system that accepts webhooks.

Supported metadata: `Attestation`, `SBOM_CYCLONEDX_JSON`, `SBOM_SPDX_JSON`

[View integration source](https://github.com/chainloop-dev/chainloop/blob/main/app/controlplane/plugins/core/webhook/v1/README.md)

### SMTP / Email

| Capability        | Description                                                         |
| ----------------- | ------------------------------------------------------------------- |
| **Fan-Out**       | Send emails containing attestation information after workflow runs. |
| **Notifications** | Receive system and product notifications via email.                 |

SMTP can be used as both a fan-out integration (attached to workflows) and a notification channel (configured at the organization or product level).

<CardGroup cols={2}>
  <Card title="Fan-out source" icon="code" href="https://github.com/chainloop-dev/chainloop/blob/main/app/controlplane/plugins/core/smtp/v1/README.md">
    View SMTP fan-out integration source.
  </Card>

  <Card title="Notifications setup" icon="bell" href="/concepts/notifications">
    Configure email notification preferences.
  </Card>
</CardGroup>

### Microsoft Teams

<Note>
  This feature is only available on Chainloop's platform [paid plans](https://chainloop.dev/pricing).
</Note>

| Capability        | Description                                                                                            |
| ----------------- | ------------------------------------------------------------------------------------------------------ |
| **Notifications** | Receive alerts about product updates, system status, and workflow events via Microsoft Teams channels. |

Check the [Notifications documentation](./notifications) for configuration details.

***

## Setting up integrations

Both Fan-Out and Notification integrations follow the same registration process. The key difference is how they are used after registration:

* **Fan-Out integrations** are attached to individual workflows
* **Notification integrations** are configured at different scopes for alerting purposes (Organization-level, Product-level)
* **LLM integrations** are registered globally, and used in agentic policies

### Step 1: Check available integrations

First, make sure that the integration you are looking for is available in your Chainloop instance:

<Tabs>
  <Tab title="Web UI">
    Go to the [Integrations](https://app.chainloop.dev/integrations) page and check if the integration you are looking for is available.

    <img src="https://mintcdn.com/chainloop/chU1iZMI9rskcnzW/concepts/img/integrations-2.png?fit=max&auto=format&n=chU1iZMI9rskcnzW&q=85&s=bd7bcb4764e2362ca9305425fa042234" alt="Integrations" width="1600" height="988" data-path="concepts/img/integrations-2.png" />
  </Tab>

  <Tab title="CLI">
    ```bash theme={"dark"}
     chainloop integration available list
    ```

    ```bash theme={"dark"}

    ┌──────────────────┬─────────┬──────────────────────┬───────────────────────────────────────────────────────────┐
    │ ID │ VERSION │ MATERIAL REQUIREMENT │ DESCRIPTION │
    ├──────────────────┼─────────┼──────────────────────┼───────────────────────────────────────────────────────────┤
    │ dependency-track │ 1.2 │ SBOM_CYCLONEDX_JSON │ Send CycloneDX SBOMs to your Dependency-Track instance │
    ├──────────────────┼─────────┼──────────────────────┼───────────────────────────────────────────────────────────┤
    │ smtp │ 1.0 │ │ Send emails with information about a received attestation │
    ├──────────────────┼─────────┼──────────────────────┼───────────────────────────────────────────────────────────┤
    │ oci-registry │ 1.0 │ │ Send attestations to a compatible OCI registry │
    ├──────────────────┼─────────┼──────────────────────┼───────────────────────────────────────────────────────────┤
    │ discord-webhook │ 1.1 │ │ Send attestations to Discord │
    └──────────────────┴─────────┴──────────────────────┴───────────────────────────────────────────────────────────┘

    ```

    <Tip>
      In addition to the UI, you can find all the available operations related to integrations in the CLI by running `chainloop integration --help`
    </Tip>
  </Tab>
</Tabs>

### Step 2: Register the integration

Registration is when a specific instance of the integration is configured in a Chainloop organization. A registered instance is then available to be attached to workflows (for Fan-Out) or configured globally (for Notifications). Each registration shows its configuration status in the UI.

In our case, as an example, we want to register an instance of the webhook integration.

<Tabs>
  <Tab title="Web UI">
    To do so, click on the integration. You'll see two sections: Registration inputs, and Attachment inputs.

    <img src="https://mintcdn.com/chainloop/chU1iZMI9rskcnzW/concepts/img/integrations-3.png?fit=max&auto=format&n=chU1iZMI9rskcnzW&q=85&s=601fa29a9fe91d1c971971c30242bae0" alt="Integrations" width="618" height="643" data-path="concepts/img/integrations-3.png" />

    **Registration inputs** are a one-time set of fields required to register the integration in your organization. In this case, the URL of the webhook. However, Attachment inputs are properties set at the workflow level, which can vary from one workflow to another within the same organization.

    Click "Add Registration" to set the URL value

    <img src="https://mintcdn.com/chainloop/chU1iZMI9rskcnzW/concepts/img/integrations-4.png?fit=max&auto=format&n=chU1iZMI9rskcnzW&q=85&s=1d8bdb36cc5c46b2313f0d522b446bcb" alt="Integrations" width="928" height="463" data-path="concepts/img/integrations-4.png" />

    <img src="https://mintcdn.com/chainloop/chU1iZMI9rskcnzW/concepts/img/integrations-5.png?fit=max&auto=format&n=chU1iZMI9rskcnzW&q=85&s=7357d64fc35e8ab7714f8570fd6daeb2" alt="Integrations" width="903" height="329" data-path="concepts/img/integrations-5.png" />

    After clicking "Register" you'll see your integration in the "Registrations" tab:

    <img src="https://mintcdn.com/chainloop/qP5Aepelxm7aUyXA/concepts/img/integrations-6.png?fit=max&auto=format&n=qP5Aepelxm7aUyXA&q=85&s=629066f77528ed4f949a9e5a97174722" alt="Integrations" width="986" height="667" data-path="concepts/img/integrations-6.png" />
  </Tab>

  <Tab title="CLI">
    Check the required **registration inputs**

    ```bash theme={"dark"}
    chainloop integration available describe --name webhook
    ┌─────────┬─────────┬─────────────────────────────────────┬──────────────────────────────────────────────────────────┐
    │ NAME    │ VERSION │ MATERIAL REQUIREMENT                │ DESCRIPTION                                              │
    ├─────────┼─────────┼─────────────────────────────────────┼──────────────────────────────────────────────────────────┤
    │ webhook │ 1.0     │ SBOM_CYCLONEDX_JSON, SBOM_SPDX_JSON │ Send Attestation and SBOMs to a generic POST webhook URL │
    └─────────┴─────────┴─────────────────────────────────────┴──────────────────────────────────────────────────────────┘
    ┌─────────────────────────────────────────────────────────────┐
    │ Registration inputs                                         │
    ├───────┬────────┬──────────┬─────────────────────────────────┤
    │ FIELD │ TYPE   │ REQUIRED │ DESCRIPTION                     │
    ├───────┼────────┼──────────┼─────────────────────────────────┤
    │ url   │ string │ Yes      │ Webhook URL to send payloads to │
    └───────┴────────┴──────────┴─────────────────────────────────┘
    ...
    ```

    lastly, register the integration providing the required input parameter

    ```bash theme={"dark"}
    # Example of registering a webhook integration
     chainloop integration registered add webhook \
     --name [unique-registration-name] \
     --opt url=[webhook-url]
    ```
  </Tab>
</Tabs>

### Step 3: Attaching Fan-Out integrations to workflows

<Note>
  For Notification integrations: Check the [Notifications documentation](./notifications) for reference.
</Note>

Once the integration is registered, the next step depends on the integration type:

Attach the integration to specific workflows. In practice this means that attestations and material information generated in those workflows will be sent to the registered integration.

<Tabs>
  <Tab title="Web UI">
    In the workflow view, click on the integrations tab:

    <img src="https://mintcdn.com/chainloop/qP5Aepelxm7aUyXA/concepts/img/integrations-7.png?fit=max&auto=format&n=qP5Aepelxm7aUyXA&q=85&s=6a2441931e6a00c989918098ae7d7899" alt="Integrations" width="986" height="667" data-path="concepts/img/integrations-7.png" />

    When clicking "Attach" you'll be presented with the list of available integrations for your organization (which were prepared in the previous step).

    When an integration is selected, you'll see the list of attachment properties that can be set at the workflow level. In this case, the two Attachment Input properties we saw in the previous section. This particular integration can receive full attestation documents, SBOMs, or both.

    <img src="https://mintcdn.com/chainloop/qP5Aepelxm7aUyXA/concepts/img/integrations-8.png?fit=max&auto=format&n=qP5Aepelxm7aUyXA&q=85&s=53c00678bb71e73c67eeca20611bd621" alt="Integrations" width="327" height="339" data-path="concepts/img/integrations-8.png" />
  </Tab>

  <Tab title="CLI">
    Check the available attachment properties, which in this case we have two optional properties: `send_attestation` and `send_sbom`.

    ```bash theme={"dark"}
    $ chainloop integration available describe --name webhook
    ┌─────────┬─────────┬─────────────────────────────────────┬──────────────────────────────────────────────────────────┐
    │ NAME    │ VERSION │ MATERIAL REQUIREMENT                │ DESCRIPTION                                              │
    ├─────────┼─────────┼─────────────────────────────────────┼──────────────────────────────────────────────────────────┤
    │ webhook │ 1.0     │ SBOM_CYCLONEDX_JSON, SBOM_SPDX_JSON │ Send Attestation and SBOMs to a generic POST webhook URL │
    └─────────┴─────────┴─────────────────────────────────────┴──────────────────────────────────────────────────────────┘
    ...
    ┌──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
    │ Attachment inputs                                                                                                        │
    ├──────────────────┬─────────┬─────────────────────┬───────────────────────────────────────────────────────────────────────┤
    │ FIELD            │ TYPE    │ REQUIRED            │ DESCRIPTION                                                           │
    ├──────────────────┼─────────┼─────────────────────┼───────────────────────────────────────────────────────────────────────┤
    │ send_attestation │ boolean │ No (default: true)  │ Send attestation                                                      │
    │ send_sbom        │ boolean │ No (default: false) │ Additionally send CycloneDX or SPDX Software Bill Of Materials (SBOM) │
    └──────────────────┴─────────┴─────────────────────┴───────────────────────────────────────────────────────────────────────┘
    ```

    ```bash theme={"dark"}
        chainloop integration attached add \
            --workflow [workflow-name] --project [project-name] \
            --integration [integration-name] \
            # and optionally set the attachment properties
            --opt send_attestation=[true|false] \
            --opt send_sbom=[true|false]
    ```
  </Tab>
</Tabs>