Tools and methods

A seven-layer, fail-fast decision gate for deciding whether to trust a given AI model for a specific use, ending in a signed Model Trust Record. A methodology, not a product: it composes NIST AI RMF, ISO/IEC 42001, CSA AICM, and OWASP into one runnable, auditable decision, and weights the work by whether the model is a cloud API or a self-hosted open-weight file. Current release v0.2.2, backed by a coverage crosswalk, four worked runs, and a directional local red-team pilot.

The eu-ai-act-blueprint repo turns the high-risk obligations into 79 engineering controls, 73 tied to a specific article, worked through for a CV-screening system. The timeline page shows when each part of the Act applies, as set by Regulation 2024/1689 as amended by Regulation 2026/1744, with status badges and a 'You are here' marker, and points to the Commission's official timeline for guidance and standards as they land.

A reference implementation of a secure-by-design AI agent with MCP tool integration. Every architectural decision is mapped to specific OWASP, NIST, or CSA controls. Defense-in-depth agent - Input guard, tool authorizer, output filter. Hardened MCP server - Path canonicalization, no shell=True, rate limiting. Validation suite - Threat model + manual red-team test cases

A single-file, three-layer red-team pipeline for a local LLM and its MCP servers, run against open-weight models through Ollama. It uses Garak, Promptfoo and PyRIT plus a built-in MCP descriptor scan, and writes one report mapped to the OWASP LLM and MCP Top 10. v0.1.0 adds capability scoping: you declare what each tool may reach, and it reports the gaps its rules check for. Limits: the descriptor scan is static and never calls a tool, and Promptfoo's OWASP preset uses a hosted test-case generator, so without a Promptfoo login that step is skipped.