Open Source
These are the tools we use in our own work, released for anyone building disciplined, auditable AI. Free to read, run, and fork, and when the default shape does not match your environment, we adapt them to fit your control catalogs, pipelines, and policies.
Make any AI coding assistant verify its work before it says "done."
A plain-markdown operating doctrine you drop into any project: a constitution of hard rules, a six-phase algorithm for non-trivial work, and a verification doctrine that refuses unverified claims. The discipline lives in the files, so it works identically across Claude Code, Cursor, Codex, Gemini CLI, Aider, and Copilot.
Grade a risk assessment the way the rubric says: deterministically, every time.
The evidence engine for security and AI governance. It grades a risk assessment as a deterministic function of the findings: it cannot skip the grade, it cannot invent a threshold, and it will not mark a control proven because the prose sounded confident. Every grade carries its basis, the row walk, not just the letter, and the default evidence state is UNVERIFIED. Zero dependencies, no network, and eight bundled control catalogs: CIS Controls v8.1, ISO/IEC 27001 and 42001, NIST AI RMF, CSF 2.0 and SP 800-53, the SOC 2 Trust Services Criteria, and CCPA/CPRA, so a cited control id that doesn't exist fails validation instead of passing as real.
Need one of these adapted to your own environment: your control catalogs, your pipelines, your policies? Tell us what you need →