Verify our engineering claims yourself.
Every claim on /engineering is reproducible from the source. Step-by-step walkthrough — clone, run, see the same numbers. The SDKs are public; monorepo read access is granted to evaluators on request. Designed for a DD engineer doing a 15-minute technical screen.
Prerequisites
- git
- node 20+ & pnpm
- ~150 MB free disk for the clone + npm cache
- No accounts, no API keys, no signups required
- A read grant on the monorepo — the GitHub links below resolve once it’s in place. Email security@evalguard.ai; the client SDKs need no grant.
Get the source
Claim
The client SDKs (TypeScript, Python, Go, Java, CLI) are public and Apache-2.0. The monorepo — where every claim below lives — is source-available: we grant read access to evaluators and customers on request, under NDA. The backend engine (scorers, red-team plugins, ML classifiers, DLP dictionaries, firewall, gateway) is proprietary; see NOTICE in the tree.
Why this is the right test
You should not have to take a claim on trust. Every command below runs against the same tree we ship from, at HEAD — the only thing gating you is an access grant, which is a same-day email, not a sales cycle.
Command (paste into your terminal)
# Public today, Apache-2.0 — no access needed: git clone https://github.com/EvalGuardAi/evalguard-go.git # The monorepo the steps below run against — email # security@evalguard.ai for a read grant, then: git clone https://github.com/EvalGuardAi/evalguard.git cd evalguard
Verify CI ratchets exist + count them
Claim
We run 81 active CI regression gates — 19 monotone ratchets + 62 hard invariants that fail PRs: RLS coverage, cross-tenant `.eq`, mass-assignment, force-dynamic, gitleaks, OpenAPI completeness, mutation-score floors, firewall latency, synth-check freshness, chaos-test coverage, migration down-coverage, and the rest.
Why this is the right test
Most pre-seed companies run 0 or 1 hard CI gates. 81, each with a deliberate-break test (ADR-0028), is a genuine engineering signal that survives PR review pressure. The number is derived, not asserted — every count on this page and on /engineering is read out of `node scripts/list-ci-gates.cjs --json`, and the script fails if any listed gate is missing from disk or unwired from every workflow.
Command (paste into your terminal)
node scripts/list-ci-gates.cjs
Count ADRs
Claim
38 Architecture Decision Records (ADR-0001 … ADR-0038) cover every load-bearing decision: encryption, RLS, audit-log signing, BullMQ DLQ, mutation testing, detection-benchmarking discipline.
Why this is the right test
ADRs are the audit trail for *why* decisions were made. Without them, a security audit gets answered with 'I think Bob in 2023 chose this' — not defensible.
Command (paste into your terminal)
ls docs/adr/*.md | wc -l
Run the firewall latency benchmark
Claim
Detection layer p95 < 5 ms, real CI-measured, regression-gated by `scripts/firewall-latency-ratchet.cjs`.
Why this is the right test
Inline firewalls go in the request hot-path. Latency is a deal-breaker for adoption. We publish the number, the script that produced it, and the CI gate that prevents regression.
Command (paste into your terminal)
pnpm install npx tsx scripts/benchmark-firewall-latency.mjs
Run the firewall detection-quality benchmark
Claim
100% recall, 100% precision, 100% F1 on a 200-prompt corpus (100 attacks across 7 categories, 100 benign queries). Reproducible via committed script.
Why this is the right test
Latency without detection-quality is 'I block nothing, fast.' This benchmark answers 'does the firewall actually catch attacks?' against an OWASP/AdvBench-derived corpus.
Command (paste into your terminal)
npx tsx scripts/benchmark-firewall-detection.mjs
Verify OSS package downloads
Claim
Our client packages are public on npm under Apache-2.0 and carry real weekly downloads: `@evalguard/sdk`, `@evalguard/openai`, `@evalguard/anthropic`, `@evalguard/otel-sdk`.
Why this is the right test
OSS adoption is independent third-party validation. Anyone can run `npm install` and see the package; download counts are served by npm, not by us, so they are auditable without trusting this page.
Command (paste into your terminal)
curl -s https://api.npmjs.org/downloads/point/last-week/@evalguard/sdk curl -s https://api.npmjs.org/downloads/point/last-week/@evalguard/openai curl -s https://api.npmjs.org/downloads/point/last-week/@evalguard/anthropic curl -s https://api.npmjs.org/downloads/point/last-week/@evalguard/otel-sdk
Inspect the synth-check history
Claim
External synthetic uptime checks run hourly from GitHub Actions. The full run history is readable with the same source-access grant as step 1. Catches outages independently of our internal monitoring.
Why this is the right test
A status page that depends on the system it's monitoring isn't a status page. GitHub Actions runs from outside our infra, so the history is an independent record — and it's the same record we read.
Command (paste into your terminal)
open https://github.com/EvalGuardAi/evalguard/actions/workflows/synth-check.yml
Read the threat model
Claim
17 threat classes documented in one place with mitigations + verifying artifacts + honest gaps.
Why this is the right test
A customer security audit asks 'how do you defend against X?' The threat model document is the rolled-up answer. Not having one means re-deriving the answer every time.
Command (paste into your terminal)
cat docs/threat-model.md | head -100
Verify the SBOM is fresh
Claim
CycloneDX SBOM generated daily by syft + grype (03:17 UTC cron in .github/workflows/sbom.yml); the run history is readable with the same source-access grant as step 1. The RFC 9116 security.txt below needs no grant.
Why this is the right test
Customer security questionnaires ask for SBOM. Generating one daily means the answer is 'here's today's, ask for any historical day' — not a 6-week project.
Command (paste into your terminal)
open https://evalguard.ai/.well-known/security.txt
If every step passed
What you have personally verified
None of this required trust — every number came out of code you ran.
Honest gaps
What we don't yet have
We list our gaps publicly because hiding them makes the positive claims less credible. Each item below has a roadmap committed to the repo:
- SOC 2: gap analysis + control-to-TSC mapping done, evidence engine live; audit process begins Q4 2026 (see /trust/compliance).
- External pentest: not done; planned post-Series-Seed funding ($10-25k).
- Vulnerability disclosure program: recognition-based (no cash rewards yet);
security@evalguard.aiopen with hall-of-fame + safe harbor. - api-handler.ts mutation score: 44.89% against a CI floor of 40% and an 85% target. Earn-then-enforce promotion order documented in ADR-0031.
- Detection corpus expansion: 200 prompts now, 500+ next via AdvBench / HarmBench / AISafetyLab.
Found a claim you can't verify?
That's a bug — file an issue and we'll fix the page (or the code). Diligence questions also go to security@evalguard.ai.