Run HAIEC where you build.
Connect HAIEC to your IDE or coding agent through MCP, trigger the canonical Assurance workflow through the API, or authorize remote source analysis through the GitHub App.
Your AI operates the workflow. HAIEC determines the evidence and Assurance result.
Already using GitHub?
Install the HAIEC GitHub App and authorize only the repositories you want HAIEC to analyze. This is the recommended path for HAIEC's current full remote static-analysis stack — no personal GitHub tokens, no local analyzer setup. Prefer Local / IDE (preview) when you want source access to stay on your machine and bounded coverage is acceptable. Add CI/CD after the first scan works.
Choose how HAIEC connects
MCP / IDE
Recommended for AI agents
Let supported coding agents discover HAIEC readiness, run Assurance, retrieve deterministic results, guide evidence resolution, and operate scenario investigations through bounded MCP tools.
Agent integration →GitHub App
Recommended for remote source analysis
Authorize selected repositories through GitHub. HAIEC binds remote source analysis to a verified Source Asset.
GitHub integration →REST API
Applications and CI
Start and poll Assurance runs, retrieve exact persisted artifacts, and submit supported qualified evidence programmatically.
API platform →Runtime & Evidence
Optional evidence expansion
Add structured evidence, typed intake profiles, logs, telemetry, or authorized runtime-test results — including scenario-bound evidence for investigations — when the Assurance question requires evidence beyond source analysis.
Evidence ingest →Supported paths converge into the canonical Assurance pipeline. Analyzer and evidence coverage can differ by source mode; unavailable evidence remains explicit.
Scan-path detail
| Path | Status | Best when | Where analysis runs | Repository access |
|---|---|---|---|---|
| Connected GitHub | RECOMMENDED — FULL REMOTE COVERAGE | Full remote repository analysis | HAIEC remote scanner | GitHub App installation authorization |
| Local / IDE scanner | PREVIEW — LIMITED LOCAL COVERAGE | Source stays on your machine | Developer machine | Not required for local analysis |
| CI/CD local scanner | PREVIEW / ENTERPRISE POC | PR/build/release evidence | Customer CI runner | No repository token sent to HAIEC |
| Runtime endpoint | AVAILABLE | Behavioral/runtime testing | HAIEC runtime infrastructure | No source repository required |
All supported paths converge into the canonical Assurance Pipeline. Analyzer coverage can differ by source mode; unavailable evidence is recorded as a limitation, never as PASS.
Independent developer security tools
HAIEC also publishes focused developer-security tools. They are separate products with their own findings and rule sets. Their output is not a HAIEC Assurance Evaluation unless a future qualified ingestion path explicitly admits it as evidence.
AI AppSec
SOURCE layer · 122 detectors · 79 checks
Static source-code analysis for AI applications and agents. Semgrep-backed.
MCP Tenant Isolation
BOUNDARY layer · 57 rules
Cross-tenant data leakage detection for MCP servers and multi-tenant SaaS.
LLMVerify
RUNTIME I/O layer · v1.8.0
Local-first LLM guardrails — hallucination risk, prompt injection, PII redaction.
Featured SDKs & Libraries
LLMverify
TypeScript/JavaScript
Local-first LLM security verification. Real-time prompt injection and PII detection with pattern-based engines and explicit limitations.
npm install llmverifyKill Switch SDK
TypeScript/JavaScript
5-layer AI system kill switch with automated compliance monitoring. Manual, semi-automated, and fully automated shutdown modes.
npm install @haiec/kill-switchISAF Logger
Python
Instruction Stack Audit Framework for evidence generation. Add 3 lines, get cryptographically verifiable lineage logs for AI training workflows.
pip install isaf-loggerREST APIs
Versioned APIs for Assurance Runs, qualified evidence submission, discovery, and structured artifacts
Assurance Runs API
Start the same canonical scan → evidence → evaluation pipeline used by the dashboard.
POST /api/v1/assurance/runsLocal / CI Evidence
Submit qualified evidence produced on a developer machine, IDE, or CI runner — no repository archive.
POST /api/v1/scansEvaluation Artifacts
Retrieve the exact persisted summary, report, Passport, and PDF with report:read.
GET /api/v1/assurance/evaluations/…Why Developers Choose HAIEC
Evidence-first
Every result states what the evidence established and what remains unknown or not assessed.
Bounded dispositions
ALLOW means ALLOW within evaluated scope and available evidence — never universal safety.
Deterministic
The agent may operate the workflow. HAIEC determines the evidence state and Assurance result.
Start HAIEC in three steps
Create an Assurance Agent key
Create a scoped API key in HAIEC. Keep it server-side and outside version control.
Create Account →Connect HAIEC to your development environment
Add the HAIEC MCP endpoint to your supported IDE or coding agent, or use the Assurance REST API directly.
Agent integration →Ask HAIEC to evaluate a system
Start with preflight. HAIEC will tell the agent what is ready, what is missing, and which supported action comes next.
View Documentation →The Capability Catalog
Everything below renders from the shipped code — the detection catalog, framework mappings, playbooks, ingest adapters, and the domain vocabulary. What you read here is what runs.
Detection catalog
Every detection rule — evidence class, hard negatives, executable vs. register-only.
Framework mappings
Real ATLAS, ASI, NIST AI RMF, WG11, and STIX IDs on real rules.
Remediation playbooks
Plain-language fix steps plus a verification check — never auto-applied.
Ingest adapters
Every evidence format HAIEC accepts today, normalized to one standard format.
Relation types
The evidence-qualified vocabulary connecting graph nodes.
Telecom entities
RAN, slice, core, and transport entities with stable identities.
Agent model
Five evidence planes, capability chain, delegation chain, DAI.
Guides
How-to guides shipped with the repository, indexed here.
Changelog
Current capability state, version-stamped — computed from the code.
Evaluate where you build
Connect your IDE or coding agent, or call the Assurance API directly. The agent operates the workflow — HAIEC evaluates the evidence.