Proof · v3.0.0 · Apr 23, 2026

Detection claims need receipts. Three components turn claims into evidence.

Every Pipelock detection claim is backed by an open corpus you can re-run, signed rules you can verify, and Ed25519-signed reports your auditor can keep. No marketing assertions. No closed-source vendor box. Run it yourself.

Apache 2.0
Public methodology
Public attack cases
Signed reports
Offline license

The three pillars

A receipt for every claim

Each pillar is a separate open-source project. Each one feeds the next.

01 / 03

Validate

189 adversarial test cases prove the scanner catches what it claims.

209 cases · 18 categories

02 / 03

Govern

Signed rule bundles. Hot-reloadable. Tampered rules never load.

Ed25519 bundles · Hot-reload

03 / 03

Attest

Signed compliance reports your auditor can verify offline.

Signed bundles · 7 frameworks

01 · Validate

Agent Egress Bench

A public corpus of adversarial test cases. The same corpus Pipelock tests itself against.

189 adversarial cases (209 total incl. 20 false-positive controls) across 18 categories: DLP evasion, prompt injection, SSRF, tool poisoning, encoding chains, hostname exfiltration, A2A scanning.
Run against any proxy. The bench is tool-neutral. Same corpus, any defender.
Public scoreboard at /gauntlet/ with verifiable per-category results.

Run the bench View Gauntlet results

02 · Govern

Pipelock Rules

Community detection patterns distributed as Ed25519-signed YAML bundles. Hot-reloadable. Tampered rules fail signature verification.

Signed bundles verified at install time. pipelock rules verify checks signatures against your trusted keyring.
Hot-reload applies bundles without restarting the proxy. Reload preserves kill-switch state.
Production signing key: 70b991eb77816fc4ef0ae6a54d8a4119ddc5a16c9711c332c39e743079f6c63e
Write your own patterns or use the official set. Install flow + trust model.

View bundle source Install flow

03 · Attest

Pipelock Assess

Generate signed security reports with compliance evidence. Auditors verify offline.

7 compliance frameworks mapped: OWASP MCP Top 10, Agentic Top 10, MITRE ATLAS, EU AI Act, NIST AI RMF, HIPAA, SOC 2.
Ed25519-signed bundles are tamper-evident. Auditors verify against the published public key.
Offline by design. No phone home, no telemetry, no third-party verification service.

Get Assess license View a demo report

Cryptographic anchors

What is signed

Three surfaces, one keyring. The same Ed25519 trust model across the toolchain.

Rules bundles

Each YAML bundle is signed at publish time. pipelock rules verify checks the signature against your trusted keyring before load. A tampered bundle fails to load and the proxy keeps the previous state.

Action receipts

Every block decision can emit a signed action receipt. The receipt is short-form (verdict, layer, classes detected, redaction class counts), and the signature is verifiable against the published public key.

Assess reports

pipelock assess writes a hash-chained bundle with Ed25519 signatures over each section. Auditors verify with pipelock assess verify using the trusted public key. No network call.

Verify yourself

$ pipelock rules verify
$ pipelock assess verify ./assessment-a1b2c3d4/
$ pipelock verify-receipt ./receipt.json --key 70b991eb77816fc4ef0ae6a54d8a4119ddc5a16c9711c332c39e743079f6c63e

The public key above is the real production signing key. Run these commands against any artifact and the trust check is offline + reproducible.

Receipts in numbers

209

Bench cases

Don't take our word for it

Three independently verifiable surfaces. Every link goes to a real artifact.

Verifiable scoreboard