List all available security checklists with item counts and frameworks.

Returns checklist name, version, description, item count, and mapped frameworks. No arguments.

Run a named checklist against a description of your AI agent or deployment.

Returns all items in the checklist with their threat, control, severity, and verification steps. Use this to assess whether your deployment meets security controls from NIST, CISA, OWASP, CUSTODY, and LASM.

Args: name: Checklist name, e.g. 'agent-containment', 'harness-engineering', 'system-hardening', 'red-team', or 'supply-chain'.

Get a specific checklist item by its ID (e.g. 'AC-001', 'HE-006').

Returns the full item with threat, control, severity, verification, and source framework references.

Args: checklist_name: Checklist name, e.g. 'agent-containment'. item_id: Item ID, e.g. 'AC-001'.

Get a step-by-step security protocol by name.

Returns the full protocol document with prerequisites, steps, verification, and rollback procedures.

Args: name: Protocol name, e.g. 'agent-deployment', 'incident-response', 'red-team-engagement', or 'harness-setup'.

Look up security controls mapped to a specific framework.

Returns all checklist items that correspond to framework controls, enabling cross-reference between NIST AI RMF, OWASP, CUSTODY, LASM, and MITRE ATLAS.

Args: framework: Framework name: 'nist-rmf', 'owasp-llm', 'atlas', 'custody', or 'lasm'.

Search all checklists for controls that mitigate a given threat.

Use this to find relevant controls for specific threats like 'prompt injection', 'credential theft', 'data exfiltration', 'privilege escalation', or 'lateral movement'.

Args: query: Threat or control to search for.

Compare two checklists and show coverage gaps and duplicated controls.

Returns items present in checklist A but missing from B, and vice versa. Matching is by normalized control text (case- and whitespace-insensitive), not by item ID, so the same control stated in two checklists (e.g. agent-containment and harness-engineering) is recognized as a duplicate. Use this to keep the catalog maintainable as it grows.

Args: a: First checklist name, e.g. 'agent-containment'. b: Second checklist name, e.g. 'harness-engineering'.

Probe a running agent deployment and return an evidence bundle.

Runs read-only probes and returns what was actually observed, per control: 'pass' (demonstrably enforced), 'fail' (demonstrably not), 'unknown' (could not tell — never counted as enforced). Feed the bundle to evidence_verify to get a grade, insights and an action plan.

Self-audit warning: when an agent calls this tool about its own host, the result is self-attestation, not assurance. The bundle records that ('provenance. self_attested') and the assessment raises it as a critical finding. Independent evidence needs cinch collect run out of band under a separate identity — see the 'evidence-collect' protocol.

Args: host: Probe the host/container running the agent (AE-001..AE-011). pid: PID of the agent process to inspect. Omit and the collector inspects itself, which is flagged as self-attestation. unit: systemd unit name of the agent, used to resolve its MainPID. project_path: Deployment directory to inspect — MCP tool grants, container manifests, CI workflows, dependency pinning, secret handling. endpoint: Running agent's HTTP endpoint for behavioural probes (prompt injection, prompt leakage, tool enumeration, rate bounds). authorized: Must be true to probe endpoint. Confirms you are permitted to send adversarial input to that target. deployment: Name recorded in the bundle.

Grade an evidence bundle: score, letter grade, insights, recommendations, plan.

Applies the same rubric a human reviewer sees in the console, and reports on the evidence itself as well as the controls — self-attested collection, unsigned bundles, and controls no probe could verify all surface as findings. 'unknown' observations stay unreviewed rather than counting as enforced.

Args: bundle_json: A 'cinch-evidence/1' bundle, as returned by evidence_collect. deployment: Optional deployment name override.