Build governed, stateful AI workflows in Java — with orchestration, persistence, and runtime observability.

ImpactGuard — Lightweight multi-language API impact analyzer

Supply-chain visibility for npm: trace install-time lifecycle scripts, file/network access, and canary secret reads; map results onto package-lock with HTML reports and optional SARIF for CI.

Runtime Cryptography Bill of Materials (CBOM) extraction via eBPF/bpftrace, generating CycloneDX 1.6 CBOMs and evaluation charts for OpenSSL-based apps.

Compositional trust analysis for Model Context Protocol (MCP) deployments. Detects authority paths that exist in practice but not in any individual server's manifest — where low-privilege tool output influences high-privilege tool execution without crossing a reviewed boundary.