Enables agents to analyze software artifacts through 35 tools covering read-only reconnaissance, secret/string/symbol scanning, native and Dart AOT structure checks, exposure tiering, protection planning, attack-simulation design, and an append-only evidence ledger with mechanical verified gates that treat unresolved unknowns as blocking. Gated execution tools apply reviewed transforms only to a managed copy inside an authorized workspace, with one-time approval tokens, independent verification, before/after diffs, and rollback.
Provides a deterministic pre-install security scan for Agent skills, plugins, and MCP servers via stdio, returning verdicts, audited badges, CI gates, and reports without executing code or making network calls.
Offers proof-only tools to inspect and verify remediation closure receipts, deterministically confirming asset coverage, fixed artifact deployment, rescanning, deadline compliance, and zero-residual closure without executing scans or touching live systems.
Enables deterministic, read-only multimodal evidence review by normalizing text, tables, PDFs, images, and screenshots into provenance metadata, with optional controlled filesystem access and no provider calls.
Evidence-backed, read-only codebase diagnostics for coding agents: secrets, dependency, RLS, and source-impact audits with a verify loop and PR review verdicts. Never writes files or uses the network by default.