01 Discover → 02 Review Risk → 03 Preview → 04 Export Evidence → 05 Configure CI

How the CipherMap Engine Actually Works Under the Hood.

Start with a reproducible local scan. Review the exact findings and remediation boundaries, export evidence when licensed, and configure connected workflows when your team is ready. Each stage below states the command and the prerequisites that affect its result.

Download CipherMap CLI (.zip)Watch Full Product Tour (1:53)Request a 7-day trial key

Five stages, with explicit prerequisites

From local findings to reviewed changes and scoped evidence

Local scanning and previews can run with offline controls. Source changes require their own verification, artifact signatures require configured keys, and connected CI workflows communicate with the services you choose.

STAGE 01Free PQC Scan · Tier B Immunity Scan
Preflight & Discover Locally
$ ciphermap scan . --offline --no-telemetry --format json -o scan.json
Run ciphermap preflight and ciphermap scan locally for Free 12-language PQC discovery (0 egress), or run Tier B ciphermap immunity scan across 12 languages to locate structural bug classes.
Language coverage: Go uses native go/ast analysis; other supported languages use language-specific detection rules across Free PQC discovery and Tier B structural sink families (IMM-BOUND-001, IMM-PATH-001). Inspect the installed catalog with ciphermap explain --list, or try the Free ciphermap demo sandbox.
Archive inspection is opt-in: add --include-archives to inspect supported Java archives and Python wheels. Source analysis and archive inspection have different coverage limits.
Certificate, configuration, native-binary, and enterprise cryptographic-call checks contribute evidence where supported. Source matches do not establish deployed configuration or runtime reachability.
Read coverage_status and errors before treating the output as a policy result. A zero-finding scan is not proof of cryptographic absence.
STAGE 02Free Gate · Licensed Profiles
Review Risk and Choose a CI Threshold
$ ciphermap scan . --offline --no-telemetry --fail-on high --format sarif -o results.sarif
Review classical weaknesses and post-quantum migration concerns in context. The free severity gate and the enterprise fleet policy ratchet are separate workflows.
The free --fail-on gate exits 1 for findings at or above the selected severity; incomplete coverage exits 2.
Commercial --target profiles such as cnsa-2.0 add standard-specific findings. They support readiness review, not a compliance certification.
For committed changes, use --diff --diff-base with a trusted Git base and sufficient checkout history. Confirm the comparison scope before using the result in CI.
Fleet policy enforcement is configured on the server and invoked through sync --enforce-policy; scan does not accept a --policy stage name.
STAGE 03Free PQC Preview · Tier A/B Entitlement for Writes & Immunity
Review Remediation & Pre-Migration Safety Candidates
$ ciphermap fix . --dry-run --offline --no-telemetry
A Free PQC dry-run (fix --dry-run) or Tier B unified preview (fix --with-immunity --dry-run) lists eligible candidates and reasons for declining other changes. It does not execute project verification, apply a patch, or prove that a migration is safe.
Use Free fix --patch for PQC candidate diffs, fix --blueprint for architectural guidance, and Tier B fix --with-immunity --dry-run to preview co-located stream/path safety sinks alongside PQC transitions.
Supported source changes require an appropriate entitlement (Tier A for classical crypto fix --apply; Tier B for immunity extinguish --apply and fix --with-immunity --apply), eligible call shapes, and explicit --allow-verify-exec consent for trusted project commands executed inside network-denied OS sandboxes.
Lazy T0/T1 differential verification separates PRE_EXISTING_REPO_ERROR and MISSING_HOST_DEPENDENCY from candidate regressions so 0 broken edits are written to disk.
Persisted digests, wire formats, unsupported modules, and ambiguous control flows are declined rather than guessed. A larger RSA key is classical hardening, not a post-quantum migration.
STAGE 04Tier A CBOM · Tier B CISA IBOM · Free Verification
Export Evidence and Establish Signing Trust
$ ciphermap cbom . --format cyclonedx --output cbom.json --offline --no-telemetry
Export Tier A CycloneDX 1.6 CBOM, SPDX 2.3 & PQC OpenVEX 0.2.0 artifacts, or Tier B CycloneDX 1.6 CISA IBOM & Immunity OpenVEX 0.2.0 (immunity attest), with Free offline verification.
Tier A CBOM and PQC OpenVEX 0.2.0 exports record detected algorithms and locations; Tier B immunity attest exports CycloneDX 1.6 CISA IBOM (ibom.cdx.json) and Immunity OpenVEX dispositions. Unknown fields and coverage limits remain part of the evidence; an inventory is not a certification.
cbom --bundle --output audit.zip creates an HMAC integrity-tagged bundle. Set an organization-controlled CIPHERMAP_SIGNING_KEY and use Free cbom --verify audit.zip or immunity attest --verify with no license required.
report --attest requires CIPHERMAP_ATTESTATION_KEY and creates a detached Ed25519 .sig. verify-report requires an independently authenticated --trusted-public-key file.
Optional composite Ed25519 + ML-DSA-65 (.pqc.sig) provenance requires separately provisioned --pqc-cert and --pqc-device-key credentials; reports also require --pqc-attest. It is not enabled by a trial key or ordinary CBOM export alone.
STAGE 05Tier B · MCP, CI & Fleet Workflow
Configure Local MCP Referee, CI & Fleet Workflows
$ ciphermap ci-review . --provider github --pr 42 --mode blocking --fail-on critical
Run ciphermap mcp locally over stdio for Cursor and Claude Code verification (0 cloud egress), commit .cursor/rules and CLAUDE.md policy ratchets, and connect CI PR review or your self-hosted fleet server when ready.
ciphermap mcp runs as a local stdio AI referee so coding agents check supported PQC and IMM-* rules before presenting edits; .cursor/rules and CLAUDE.md keep repository guardrails explicit.
PR review requires provider authentication, a trusted PR base, and the exact PR-head checkout. Replace the example PR number with your own.
Jira reconciliation runs when an operator invokes jira --resolve-remediated against the appropriate repository and Jira configuration; a merge alone does not invoke it.
sync requires --server-url and a repository-scoped --ingest-token (cmri3.*). Keep admin credentials and the ingest-token signing key out of CI.

Inside Stage 03 · Bundled Fixture Preview

A Candidate Is Different from an Applied Patch

Annotated dry-run excerpt · No project tests or changes executed

SOURCE · RSA-1024 KEY GENERATIONsample-vault/main.go:16

// Actual fixture finding: PQC-GO-AST-007
key, err := rsa.GenerateKey(rand.Reader, 1024)

PREVIEW · CLASSICAL HARDENING CANDIDATENot applied or verified

Candidate: increase RSA key width to 3072 bits.
Requires --allow-verify-exec and clean project tests.
This is transitional hardening, not PQC readiness.
Other fixture findings receive decline reasons.

Fail-Closed Verification Architecture

Lazy T0/T1 Fault Isolation, 4-Gate Sandboxes & Self-Healing LKG Rulepacks

Every automated rewrite and rule update in CipherMap is bounded by explicit fault attribution and cryptographic verification. Ambiguous control flows are declined, and static or sandbox checks never claim to certify runtime systems.

01 · Lazy T0/T1 Fault Attribution

0 broken edits written on dirty or incomplete repos

Before writing any supported candidate, CipherMap checks host toolchains (MISSING_HOST_DEPENDENCY) and runs a lazy baseline check (T0) on the unmodified workspace. Pre-existing build or test errors are reported as PRE_EXISTING_REPO_ERROR rather than misattributed to a candidate patch (T1).

02 · Pre-Migration Shield & MCP Referee

--with-immunity, 4-Gate sandboxes & ciphermap mcp

Supported immunity extinguish and fix --with-immunity recipes inspect co-located memory/stream (IMM-BOUND-001) and path containment (IMM-PATH-001) sinks inside network-denied OS sandboxes, while ciphermap mcp verifies Cursor and Claude Code proposals over local stdio.

03 · Signed LKG Self-Healing Rulepacks

Composite Ed25519 + ML-DSA-65 + canary fallback

Dynamic rule bundles require valid composite Ed25519 + ML-DSA-65 (.pqc.sig) signatures and pass embedded canary self-tests before activation. If a rule bundle fails signature or canary checks, CipherMap automatically falls back to the Last-Known-Good (LKG) verified rulepack.

Hands-On Verification

Test CipherMap Right Now—In Your Terminal or Browser

Read Verification Methodology →

Offline Fixture Quickstart

Download CipherMap CLI (.zip)

Run the bundled fixture with explicit offline scan and read-only preview commands.

Download CLI (.zip)

Optional Licensed Evaluation

Request a 7-Day Pro Trial

Evaluate supported Tier A workflows with one auditor seat on one repository. Key issuance depends on signing availability.

Request a trial key

Browser-Local Canvas

Interactive CBOM Visualizer

Inspect CycloneDX 1.6 cryptoProperties and algorithm risk in your browser.

Open Visualizer

4 Language Presets

Multi-Language Playground

Test detection rules against Node.js, Go, Python Kyber, and Java HSM snippets.

Open Playground

Maturity boundary

One product direction, three explicit access states

The tiers describe capability boundaries. They do not imply that every capability is generally available or production-qualified today.

Free Evaluation Pack

Available for local evaluation

Download the native CLI and bundled fixtures. Local discovery, severity gates, and remediation previews do not require a paid credential. Evaluation packages are distinct from promotion of the general installer release.

Standalone Auditor · Tier A

Requires a valid entitlement

Adds supported readiness profiles and evidence generation. Signing keys and verifier trust anchors require separate provisioning; a license does not establish signing trust.

DevSecOps Enterprise · Tier B

Configured with your team

Adds supported provider and fleet workflows. Agree repository scope, service configuration, platform qualification, and recovery expectations during the guided pilot.

Evaluate the engine on your own codebase

Start with a free local scan, then request a 7-day Pro Trial key if you need licensed evidence workflows. Trial issuance depends on signing availability. For a team rollout, request a 25-minute engineering demo to agree the scope and acceptance of a 30-day pilot. Reference Partner pricing requires separate eligibility review and written terms.

Request a 7-day trial key Plan a team evaluation Plan a technical evaluation