Agent
Business-impact gate. Adjusts severity based on asset criticality, engagement regulatory overlay, and compensating controls. Does NOT veto findings.
498 1mo ago A 32 tokens
original MIT
498Stars on the repository
61Mods indexed here, across every type
1mo agoLast push, which is what freshness is scored on
MITLicence, which decides whether bodies are shown
Agent
Deterministic (not LLM). Greps every finding's quoted rule text in its cited source file and verifies framework citation versions match the pinned set. Mismatches → quarantine.
498 1mo ago A 41 tokens
original MIT
cto-reviewer
03Agent
Technical truth gate. Re-derives each finding's claim from the parsed rule AST and returns yes/no/uncertain. Uncertain findings route to held/ for human reviewer.
498 1mo ago A 40 tokens
original MIT
qa-reviewer
04Agent
Editorial gate. Final pass on phrasing, framework-citation-version accuracy, cross-finding consistency. Flags (never blocks) findings that need author attention.
498 1mo ago A 35 tokens
original MIT
Agent
20+ year offensive security reviewer. Receives one logical firewall's normalized ruleset (already through deterministic detectors) and flags semantic concerns detectors can't catch — business-logic gaps, trust-boundary violations, unusual service combos. 2-4 instances dispatched in parallel during /launch.
498 1mo ago A 62 tokens
original MIT
Agent
Role brief for the dynamic-tester agent — performs runtime / negative testing (Perform / Test methods) against an authorized running instance for PCI SSS v2.0 dynamic Test Requirements, capturing dynamicobservation evidence. When no running instance is authorized, the requirement is REQUIRESMANUALREVIEW, never a faked…
498 1mo ago A 73 tokens
original MIT
Agent
Role brief for the evidence-gatherer agent — collects source-code and documentation evidence for a PCI SSS v2.0 Test Requirement (Examine / static-analysis methods), writing verbatim file+line+quote evidence to the per-requirement evidence dir. Mounted by the workflow Gather phase.
498 1mo ago A 67 tokens
original MIT
Agent
Role brief for the blind refutation-validator agent — independently tries to disprove a proposed MET/NOTMET PCI SSS v2.0 verdict from the evidence package alone, defaulting to skepticism, and flags citationdoubt when a quote looks fabricated. N run in parallel per requirement; a majority refute kills the verdict.
498 1mo ago A 71 tokens
original MIT
Agent
Role brief for the verdict-assessor agent — assigns a RequirementVerdict (MET / NOTMET / PARTIALLYMET / NOTAPPLICABLE / REQUIRESMANUALREVIEW) to a PCI SSS v2.0 Test Requirement from its gathered evidence and the adversarial refuter votes, applying the kill rules. Mounted by the workflow Assess/Verdict step.
498 1mo ago A 82 tokens
original MIT