Know the risk before you ship AI.
What does it really risk to put this AI application in front of users? A free, open source tool that answers from the design: the model, the data it touches, retrieval, agents and the tools they can call. You describe the system; no code or data leaves your hands.
From a description to a test plan.
- 01
Describe
The model and provider, what data enters, retrieval, agents, tools or MCP servers, and who uses it.
- 02
Map
The risks that apply to that design, and how severe they are for it, not for AI in general.
- 03
Control
The controls that reduce each risk, and who should own them.
- 04
Test
What a pentest should try to prove before the risk is accepted.
A risk report you can act on.
Mapped to the frameworks
Each risk linked to the references your buyers and auditors already use.
- OWASP LLM and Agentic Top 10
- MITRE ATLAS
- NIST AI RMF
Severity by design
An agent that can send email is not a chatbot. Severity follows what the system can actually do.
- Data exposure
- Tool and permission abuse
- Prompt injection paths
Controls and owners
Practical controls, not principles: what to change and who decides.
- Access and scopes
- Logging and retention
- Human approval
Regulatory notes
Where the EU AI Act may apply to the use case, flagged for review.
- Risk category hints
- Documentation to keep
A test plan
The attack paths worth proving with a pentest, in priority order.
- Ready to hand to a tester
Open by default
Governance should not be a black box. The rules are readable, versioned and open to contributions.
- Runs locally
- Free to use
The tool tells you what could fail. A pentest shows what does.
| The tool | The pentest | |
|---|---|---|
| Answers | What could fail | What does fail |
| From | A description of the design | Your running app, on staging |
| You get | Risks, controls and a test plan | Reproducible evidence and a review |
| Cost | Free and open source | Fixed price, quoted up front |
- Input
- A description of your system, typed or uploaded as a document or PDF. No code, no data.
- Output
- A risk register, controls with owners and a test plan.
- Mapped to
- OWASP LLM Top 10, MITRE ATLAS, NIST AI RMF
- Runs
- Locally. Nothing leaves your machine.
- Status
- In development · free and open source