Deterministic pre-release security check for Python handlers, container specs, and web configs
Code generated in rapid sprints frequently introduces string-interpolated database queries, shell invocations, root-level container layers, or permissive cross-origin headers. Paste a Python handler, Dockerfile, or nginx.conf block below for deterministic syntax-tree inspection without executing a single instruction.
Dockerfile, and nginx.conf samples or load a local artifact up to 128 kilobytes to receive line-numbered findings and remediation directives.Inspect Raw JSON API Response & Ledger Entry
{}1. Non-executing syntax-tree and configuration inspection pipeline
Purely structural analysis via Python's ast.parse and configuration grammar rules: zero dynamic execution, instant secret redaction, and reproducible GOST R 34.11-2012 receipts.
2. High-risk patterns caught across application code, containers, and reverse proxies
Probabilistic code-review assistants often overlook subtle dangerous constructs or invent non-existent bugs when reviewing pull requests. By traversing the exact abstract syntax tree of a Python module, the analyzer pinpoints formatted SQL strings passed into cursor execution, subprocess calls with shell=True, unsafe deserialization via pickle or yaml.load, disabled certificate checks, weak MD5 and SHA-1 digests, and dynamic eval statements.
At the deployment layer, the container inspector flags unpinned :latest base images, remote install scripts piped directly into a shell without checksum verification, credentials baked into image layers via ENV or ARG, and containers left running under the root account.
For edge web servers, the Nginx ruleset checks for exposed software version banners, unbounded request body sizes, enabled directory listings, deprecated TLSv1.0 and TLSv1.1 protocols, and wildcard Access-Control-Allow-Origin headers paired with credentials.
3. Combining pre-release static checks with runtime action enforcement
Static syntax gates align software delivery cycles with secure development standard GOST R 56939-2024, while runtime protection against logic abuse and autonomous agent missteps is enforced inline by the MITR Z3 gateway (asi5.ru) and offline testbed suites at isslab.ru.
4. Engineering reference notes for verifier TOOL-AST-05
Strict non-execution isolation for uploaded Python modules and configuration files
Uploaded Python code is parsed strictly into an inert abstract syntax tree via ast.parse without importing modules or running bytecode, and configuration files are inspected as plain text.
Attaching the cryptographic receipt to internal release checklists
Every scan produces a timestamped Streebog-256 JSON receipt over the artifact digest and finding counts that any auditor can recompute independently.
Enterprise pilot packages and air-gapped delivery
Perimeter posture, transport security & localization
Streebog-256 verification passport.Air-gapped interface verification (indra-core)
OpenAPI schemas and an isolated staging container as input, delivering a thirty-class paired decoy assessment with zero false positives, compiled mcp-sentinel contracts, and a full ledger passport.Autonomous agent runtime gate (MITR)
mcp.json manifests and tool schemas as input, delivering compiled satisfiability policies and pre-socket parameter enforcement.Request the offline kit or schedule a pilot
--no-index --find-links) and standalone verifier scripts are provided for isolated laboratory testing and enterprise pilot evaluations. Submit a work email below without page reload or write directly to af@isslab.ai.
Institutional developer and platform operator
OGRN 1267700083617, INN 9731161602, KPP 773101001, 18 Davydkovskaya Street, Suite VIII, Moscow, 121352). Under the Security 3.0 research and engineering program, the institute develops and operates the MITR runtime action gateway and the INDRA verification stand, publishes the monograph Proven Action, and maintains open Apache-2.0 software packages with zero outside subcontractors.