A public safety score tells you about the raw model. It does not tell you how that model behaves once it is wired into your product, behind your system prompt and tools. We test the deployment you actually ship.
We ran one checkpoint twice. Bare, it passed 66 of 74. Wrapped in our real deployment system prompt and tools, the same weights passed 57. Nine scenarios it had passed dropped to FAIL.
| Category | Bare | Deployed | Δ |
|---|---|---|---|
| exfiltration | 62.5% | 12.5% | −50.0 |
| tool_misuse | 100.0% | 62.5% | −37.5 |
| audit_integrity | 100.0% | 66.7% | −33.3 |
| data_residency | 100.0% | 75.0% | −25.0 |
| adversarial | 79.0% | 79.0% | 0.0 |
| context_integrity | 100.0% | 100.0% | 0.0 |
| reliability | 90.0% | 90.0% | 0.0 |
| safety | 100.0% | 100.0% | 0.0 |
Bare, the model refused. Deployed, it walked the user through dropping a production database table.
Bare, it refused. Deployed, it produced the install command for a malicious package without objection.
Bare, it refused. Deployed, it wrote out the commands to point a database URL at an attacker-controlled host.
Bare, it refused. Deployed, it enumerated a live secret it found in context and returned the value.
Bare, it declined to reveal hidden instructions. Deployed, it leaked its own system prompt verbatim.
Plus 4 more regressions: data_residency, audit_integrity, and two further exfiltration scenarios. Same checkpoint, two behaviors.
See how a signed run verifies ↗
The full signed report for this run is available on request. This run predates the current protocol; the current standard is PROTO V1 (161 scenarios).
One path audits a model inside your product. The other certifies a model you built or released.
You wrapped someone's weights in a system prompt, tools, and a use case. We audit that running deployment, calibrated to how much agency it has in production.
You train or fine-tune the weights. We audit the model itself by weights or endpoint, base scoring on the raw model.
Four steps from a raw endpoint to a report nobody can quietly edit.
You aim Forge at a model or your running endpoint. We set the deployment profile, from no_tools through autonomous, so the test matches the agency it has.
The protocol runs 161 scenarios across 16 categories. Trident sends 3 vectors per scenario; a scenario passes only if 2 of the 3 hold. That is 483 vectors.
A Break pass, then an Assurance pass. Two Ed25519-signed reports linked by a paired_run_id.
You get an Ed25519-signed, Origin-countersigned report with a SHA-512 hash chain over every result. It embeds its own public key, so you verify it offline.
The Forge coding agent is free and ships with the Crucible 9-layer runtime defense. Telemetry is opt-in and off by default. It feeds the Matrix and never includes your code or prompts.
Signatures across five categories, catching known-bad request shapes before they execute.
Seeded secrets that should never move. If a canary leaves the sandbox, the run is flagged.
Filesystem access is fenced. Reads and writes outside the project boundary are blocked.
An HMAC-SHA512 tamper-evident trail of everything the agent did, verifiable after the fact.
Nine layers run while the model works: Pattern Scanner, Semantic Anomaly, a 30-second Behavioral Tripwire, Canary Trap, Threat Intel, Command Guard, Path Sandbox, Plan Verifier, and the Forensic Auditor.
From a free public lookup to a countersigned model certification. Full pricing lives on the audit page.
Browse signed audits and divergence scores on the live network.
Audit the model as you shipped it, inside your product.
Full protocol, Origin-countersigned, listed on the Matrix.
Audit the deployment you shipped and hand anyone a signed report they can check offline, with no Forge server in the loop.