TRUSCOR
Had an AI incident? Get rated
SOVA OSS · Free · Apache-2.0

Metasploit for AI security.

A free, open-source security platform for AI agents, and the system of record for agent security. It gives developers, security engineers and researchers something useful every day. Adoption is its only metric, so nothing in it protects a sale.

terminal
$ npx sova check# a 60-second check before you install a component $ sova trace# record your agent as a signed .sova-trace $ sova rehearse# rehearse a real task in a cloned environment
What it does

Map it, attack it, record it.

Two purposes: to give developers, security engineers and researchers something useful every day, and through that, to build TRUSCOR’s credibility in AI security.

Fig. 01One loop, every day
The six steps in words
1Maps every agent, MCP server, skill, tool, permission and egress path you actually have.
2Attacks them.
3Records everything as a signed .sova-trace.
4Reconstructs what happened and attributes fault with counterfactual re-runs.
5Packages any attack as a portable .sova file anyone can re-run.
6Watches continuously, so a model update that breaks safety is caught the same day.
What it contains

Seven verbs, one command line.

Every verb writes to the same signed record, so a finding from one can be replayed, explained or shared by another.

Fig. 02Seven verbs, one signed record
Each verb in detail
01Record sova trace The flight recorder. It wraps an agent and captures prompts, tool calls, memory, retrieval, MCP traffic and egress as a signed trace.
02Discover sova map Finds every agent, tool, permission and egress path, including reach through delegation.
03Test sova checkdetonatecomposearenarehearse 60-second checks; trigger hunting for “sleeper” components (clean for 340 runs, malicious on run 341); attacks on combinations of components; agents attacking agents; and a safe rehearsal of your own agent’s real task in a cloned environment.
04Explain sova forensics Reconstruction, the decision point, fault attribution by layer, and counterfactual proof, always stated as a probability, never a verdict.
05Prove sova evidenceverifyreplay A technical file marked “self-generated evidence, not an independent attestation”.
06Watch sova sentineldiff Continuous regression testing of your own agents on every model update or deploy.
07Share sova registryadjudicatedisclose A community library of .sova tests and vulnerabilities, resolution of conflicting scanner verdicts by execution, and responsible disclosure with a 90-day clock.
Build on it

Clash agents. Share what breaks.

Fig. 03The arena and the registry
Arena The Arena Clash agents against each other, or throw SOVA’s attacker swarm at your own defences, fully instrumented and logged.
Registry The Registry The shared library of vulnerabilities and tests, with a verified tier for independently reproduced ones.
Students CTF mode Capture-the-flag challenges for students and teams learning AI security.
Extend Extension SDK Build on the engine with your own attackers and judges.
The format underneath

.sova and .sova-trace.

A security researcher can publish an exploit as a .sova file anyone can re-run, with a reproduction rate (for example “reproduced 8/10”) that separates structural flaws from flukes. The .sova v1.0 preprint was published in August 2026 under CC BY 4.0.

The full format →
Fig. 04Capsule, trace and verifiers
The format in words
A .sova capsule A portable, re-runnable AI exploit or test. It binds a declared behaviour, a context envelope, evidence requirements, and trials and limitations. Opening it never authorises execution.
A .sova-trace A canonical stream of observable events and evidence that keeps identity, actor, sequence, causal parents, redaction state and integrity linkage.
Integrity Canonical JSON, a per-event SHA-256 hash chain, and a signed manifest (DSSE and in-toto, Ed25519).
Verifiers Independent verifiers in Python and Node that agree on every digest.
Cause by replay What the AI was shown, what it did and what changed, linked by causal parents. The cause is established by re-running the moment with one factor removed.
New capabilities

New in the toolkit.

Available
Basic open O.W.L A basic version of the instrument that sets up arena environments and referees what each agent actually did.
Available
“CVE for tool behaviour” Registry entries for tool and skill behaviour, fed by behavioural tool testing.
Available
Open incident profile The .sova incident profile published for anyone to adopt.
The boundary with TRUSCOR

If it helps you find and fix your own problems, it is in SOVA OSS. If it makes someone else trust you, it is TRUSCOR’s.

Fig. 05Evidence about yourself, or a rating someone else relies on
SOVA OSS · free, open TRUSCOR · paid, closed
Evidence: facts you generate about yourself Attestation: an independent party’s rating that someone else relies on
The engine and a working reference attack strategy Private attack intelligence, corpus-tuned generation, per-client tuning
sova evidence, clearly labelled as a self-assessment The TRUSCOR Rating and reports
sova sentinel for your own systems, reported to you Continuous Rating that third parties can rely on
.sova, .sova-trace and verifiers TAFAAR, the corpus, the threat feed
Who uses it and how

Free for everyone who builds.

Developersnpx sova check on a component before installing it, sova trace on their agent, and sova rehearse before letting an agent loose on real work.
AI experts and security researchersThey write and share .sova exploits, hunt sleeper components, run arena matches, and extend the engine with their own attackers and judges.
StudentsCTF mode.
EnterprisesThey run it internally as a free first line of evidence, then come to TRUSCOR when someone else must rely on the result.
Status About 60,000 lines of Python. Built with strict engineering hygiene. All the verbs, the arena, the registry and forensics are in the release. Live execution runs across browsers, desktop apps and terminals through the basic open O.W.L.
Licence Apache-2.0. Free. TRUSCOR earns from it only indirectly: credibility, adoption of .sova, and teams who later need an independent rating. It runs fully locally, so no user ever depends on TRUSCOR’s servers. Optional · metered hosted tier for heavy test generation

When someone else must rely on it.

SOVA OSS results are self-assessments. A TRUSCOR Rating is an independent party’s rating that someone else can rely on.