Must validate JWT
Must rate-limit
✓ Semantic: 89
✓ Spec match: 91
✓ 47 files analyzed
Score: 87/100
→ PDF Export
→ Audit Trail
Verify AI-generated code
before it ships.
Your AI coding assistant writes code. Cognium proves it's safe. Semantic analysis catches what pattern matching misses.
Install as a GitHub Action, use our CLI scanner, or try it right now — no signup required.
One sentence → Trust score
Declare your intent in plain English. Cognium compares your code against that intent using semantic analysis. You get a trust score (0-100) and a detailed report.
Write your intent
"Add Stripe payment retry logic for failed transactions"
spec.md
Cognium analyzes
5 parallel analyzers: dependencies, patterns, semantics, behavior, spec compliance
Get your report
Trust score + gap analysis + shareable PDF. Ready for PR review or audit.
What's a Specifica spec?
It's a simple markdown file (spec.md) where you declare what your code should do in plain English. Think of it as a contract between your intent and the AI's output. Cognium diffs your code against this spec to find gaps.
Learn more about Specifica →We prove what agents did.
Your AI coding assistant generated code. Did it follow your intent? Did it introduce vulnerabilities? Did it match your spec? The Trust Engine answers these questions with deterministic proof — not probabilistic guessing.
Multiple parallel analyzers
Dependency, code pattern, semantic, behavioral, and spec compliance — running simultaneously.
Intent augmentation
State what you need in one sentence. Cognium reads your code, understands what exists, and shows you the gap between your intent and your reality.
Every source type, one engine
Custom code, ecosystem MCPs, community skills, and LLM-generated — all scanned the same way.
One YAML file. Every PR gets a trust score comment. No signup required.
View on GitHub →We also scan agent skills.
Beyond your code, we scan the skills your agents discover at runtime. Every skill in the registry is trust-scored. Malicious skills are revoked. Your agents only see what's safe to use. Available at runics.net.
Your private skills are your IP
Private skills registered by your organization are weighted higher and prioritized in your agents' queries. Your internal capabilities always surface first — and never leak to the public registry.
Enterprise? We've got orchestration.
For larger teams, we provide full release orchestration with trust-gated approvals. Start at L1 (manual gates), progress to L2 (approve-by-exception), earn L3 (autonomous deployment). Your risk committee gets compliance artifacts as a pipeline byproduct.
Note: Most developers don't need this. If you're a team of <10 and just want to verify AI-generated code, stick with the GitHub Action or CLI scanner.
Benchmarked. Tested. Verifiable.
Trust Score: 0–100
A single score for every component. Machines consume it at runtime. Humans read it in the audit trail.
Significant findings. Advisory warnings.
No spec. Some findings. Use with caution.
Clean scan. Partial or no spec match.
Code matches spec. All analyzers passed.
Critical severity. Permanently excluded.
The largest agent skill audit.
Source Safety
Ecosystem Coverage
Note: Cognium scans agent skills; others scan MCP servers. Different attack surfaces.
3 sync pipelines on cron. The registry grows while you read this page.
Try it now. No signup required.
Scan any public GitHub repository in seconds. Get a trust score, detailed findings, and a shareable PDF report.