The evidence layer is open. Verify without trusting us.
The core of Sectum AI is Apache-2.0: the marker substrate, the attack catalog, the backend adapters, the evidence chain, and an independent verifier. Anyone can reproduce a run and check a Sectum AI evidence pack end-to-end, with no Sectum AI installation and no trust in us required.
What it is, mechanically. Sectum AI is a black-box prober, not a code scanner. It never reads your source, there is no repository argument and no ingest step. It provisions synthetic tenants and users, plants canary markers it generated itself, and checks what a running stack actually returns across the surfaces static analysis cannot see: the vector store, retrieval, the cache, an agent's memory. On the scaffolded configuration it runs offline, with no network calls at all. Every destination it can ever reach is enumerated in data residency and network egress.
See it run
The four-command flagship workflow on a fresh checkout: seed synthetic tenants, run the probe suite, build the signed evidence pack, then verify it independently. Reproduce it from the runnable OSS example.
$ sectum-ai seed --workdir .sectum-ai
seeded the synthetic substrate → out/substrate.json
$ sectum-ai probe --workdir out
ran 12 probes: 325 confirmed cross-tenant findings
retrieval-pivot rate: 81.2% (95% CI 68.1%-89.8%, n=48)
$ sectum-ai report --workdir out
evidence pack → out/evidence.json
audit pack → out/audit-pack.pdf
$ sectum-ai verify out/evidence.json --allow-unanchored
[ok] schema-version · manifest-consistency · audit-pdf · in-toto-attestation · dsse-envelope
INTEGRITY OK - UNANCHORED: internally consistent, but its only timestamp is a
reproducible local-dev token. Re-create with `report --tsa`/`--rekor` for an anchored attestation.
That is the verbatim output of the linked example, unanchored because it
runs offline with no network calls. Adding --tsa and
--rekor to report upgrades the final line to
VERIFIED (independently anchored), which is the form the
twelve evidence packs from real targets carry. Note the rate measures the
stack under test, not the tool: point the adapter at a properly
isolated store, one namespace per tenant, and the same probe reports 0%.
What's in the Apache-2.0 core
Marker substrate
Synthetic tenants seeded with three classes of cryptographic canary markers and a hashed ground-truth manifest, deterministic and reproducible, with every confirmation tied back to a planted marker.
Attack catalog
11 cross-tenant attack classes across 13 AI surfaces: the organic entity-bleed RAG pivot, semantic-cache contamination, the MCP confused-deputy, memory contamination, embedding inversion, and more.
Backend adapters
Live adapters for the common vector DBs, caches, agent frameworks, and MCP servers, so the probe suite runs against a real deployment rather than a mock.
Evidence chain + verify
Canonicalize, hash, RFC-3161 timestamp, Sigstore-Rekor log, wrap in an
in-toto envelope, render to a PDF, and sectum-ai verify
checks the whole chain with no Sectum AI install required.
An attestation you can't check is just a claim
If the only way to trust an isolation report is to trust the tool that produced it, it isn't an attestation. That's why the evidence layer is open: an auditor, a customer's security team, or a regulator can take a Sectum AI evidence pack and verify the run digest, the manifest hash, the RFC-3161 timestamp, and the Rekor inclusion proof themselves, including the negative result that nothing leaked. The boundary between the open evidence layer and the commercial tooling is documented in ADR-0002.
Get startedClone it, run it, verify it
Apache-2.0. Star the repo, open an issue, or reproduce a run from the examples. When you need an attestation for a buyer or an auditor, the engagements build on this same open core.