Know if an AI dependency is safe — before production.
Designed to turn package review from a manual afternoon into an automated, signed report.
Illustrative audit view — fields mirror the real signed report
Stars don't predict production behaviour.
Reputation can't reveal real memory use, CVEs in the dependency tree, or how a tool behaves when an agent drives it.
Measure it in a sandbox. Sign what you saw.
Isolated execution, a real SBOM, CVE matching and OWASP LLM probes — packaged as an Ed25519-signed report any third party can verify.
Unknown package → verified.
Sandbox, SBOM, evidence bundle, signed report.
Isolated run — measured, not claimed
Real bill of materials + CVE match
Portable, verifiable offline
Composite of measured signals
Full chain of custody
What you attach to the ADR
The same three views, on every product.
An evidence card, a timeline and a trust score — identical components everywhere, so what you learn on one product transfers to the next.
What changes after you adopt it.
Designed to cut package review from hours to minutesEvidence collection is automated instead of hand-assembled.
Risky dependencies caught pre-productionCVEs and unsafe behaviour surface in the sandbox, not in prod.
Verifiable audit evidenceAttach a report auditors can check without trusting us.
A standard for AI package evaluationEvery tool measured the same way; every version comparable.
Evidence at every layer.
Isolated sandbox
Docker execution — probing never touches your infrastructure.
Real SBOM & CVE
syft + grype; a failed scan is reported failed — never clean.
OWASP LLM Top 10
Behaviour mapped to prompt injection, excessive agency and more.
Contributor quorum
Independent signed runs must agree — trust from agreement.
Keys stay local
Contributor private keys never leave their machines.
Verify offline
Signatures check against public keys — no trust in our servers.
Coverage reflects tools actually processed — not the addressable market. A report certifies a specific version under a specific test: strong evidence for review, not a warranty of safety.