How CipherMap Compares to Cloud SAST, Legacy SBOM Scanners & Standalone AI Agents
Dependency SBOM tools cannot see cryptographic call sites, cloud SAST scanners require egress and skip .jks/.p12 keystores, and standalone LLMs hallucinate deprecated Round 3 Kyber/Dilithium drafts. CipherMap combines 12-language local PQC discovery, signed CycloneDX 1.6 CBOM/IBOM evidence, and compiler-verified remediation in one zero-egress binary.
Side-by-Side Technical Capability Matrix
Grounded in CipherMap v1.0.0 CLI flags, fail-closed exit codes, and CycloneDX 1.6 attestation schemas.
| Requirement / Audit Dimension | CipherMap CLI (v1.0.0) | Cloud SAST (Semgrep / Snyk / Sonar) | Package SBOM (Syft / Trivy) | Standalone LLM Agents (Unverified) |
|---|---|---|---|---|
Zero Source-Code & Prompt Egress (--offline --no-telemetry) Executes locally on workstations, CI runners, and disconnected enclaves without uploading source files, secrets, or ASTs. | Yes Static native binary + local stdio MCP (0 bytes egress) | Partial Often uploads ASTs, snippets, or policy telemetry to vendor cloud | Yes Local lockfile inspection, but no source/crypto AST depth | No Streams source context to hosted model APIs unless air-gapped |
12-Language AST + .jar/.whl Bytecode + .jks/.p12 Keystores + PKCS#11 HSM Inspects source trees alongside compiled JVM/Python archives, X.509/JKS/PKCS#12 keystores, ELF/Mach-O/PE symbols, and HSM mechanisms. | Yes Single-pass 12-language AST + archives + keystores + binaries (232ms median) | Partial Source rules only; blind to .jks/.p12 keystores & compiled .jar constant pools | No Lists package versions (e.g. openssl); cannot see RSA-1024 vs ML-KEM call sites | No Cannot deterministically audit binary archives or keystore certificates |
NIST FIPS 203 / 204 / 205 vs. Pre-Standard Round 3 Draft Drift Distinguishes finalized ML-KEM, ML-DSA, and SLH-DSA parameters from wire-incompatible Round 3 Kyber/Dilithium drafts (PQC-PRE-001..005). | Yes 101+ PQC & classical crypto rules mapped to CNSA 2.0, OMB M-23-02 & NIST IR 8547 | Partial Basic MD5/SHA-1 checks; lacks FIPS 203/204/205 & Round 3 wire-drift rules | No No algorithm parameter or NIST FIPS 203/204/205 validation | No Frequently suggests deprecated Round 3 kyber768/dilithium3 imports from training data |
Signed CycloneDX 1.6 CBOM + CISA IBOM + Composite Ed25519 + ML-DSA-65 (.pqc.sig) Produces machine-readable cryptographic and immunity bills of materials with dual classical + post-quantum detached signatures. | Yes CycloneDX 1.6 cryptoProperties, cbom --diff, SPDX 2.3, OpenVEX 0.2.0 & .pqc.sig | No Proprietary CSV/PDF dashboards or SARIF without signed CycloneDX 1.6 CBOM | Partial Generates package SBOMs, not call-site CycloneDX 1.6 cryptoProperties or .pqc.sig | No Non-deterministic prose summaries; cannot sign audit-grade CBOM evidence |
Fail-Closed Coverage Contract (coverage_status: complete | incomplete) Refuses to emit a silent clean pass when archives, keystores, or source files fail to parse (exits code 2). | Yes Explicit exit 0 (clean), exit 1 (policy findings), exit 2 (incomplete coverage) | Partial Frequently skips unparseable files with warnings while returning exit 0 | Partial Skips unrecognized binary artifacts silently | No Context-window truncation omits files without deterministic completeness tracking |
Compiler & 4-Gate Sandbox-Verified Remediation + Local MCP Referee Validates candidate patches against AST sink removal, clean build, existing test suites, and network-denied negative-witness tests. | Yes Gate 2 PQC fix --apply, Tier B 4-Gate immunity extinguish & local stdio ciphermap mcp | Partial LLM autofix suggestions without local 4-gate negative-witness sandbox execution | No Version-bump hints only; no AST refactoring | Partial Fast code edits, but requires CipherMap MCP referee to block unsafe crypto/SQLi regressions |
Predictable Flat Licensing ($0 Per-LOC & $0 Per-Scan Overages) Transparent annual or monthly bands scoped by repository or active 90-day contributors with unlimited lines of code. | Yes $0 Free Discovery · $4,999/yr Tier A Auditor · $9,999–$49,999/yr Tier B Fleet | No Opaque enterprise quotes with per-LOC or per-seat true-up penalties | Yes Open-source CLI or container-indexed SaaS | Partial Per-seat + token metering; still requires deterministic CI & CBOM tooling |
Air-Gapped & Regulated Ready
Run ciphermap scan --offline --no-telemetry inside SCIFs, defense enclaves, or PCI-DSS 4.0 CDE runners without opening outbound firewall rules.
832-Repository Empirical Benchmark
Evaluated across 832 production repositories with a 232ms median local scan latency, catching keystore, archive, and pre-standard Round 3 PQC drift missed by package-only SBOMs.
Read the 832-repo study →Local MCP Referee for Cursor & Claude
Keep your AI coding velocity while enforcing deterministic security gates: ciphermap mcp --workspace . verifies candidate diffs locally over stdio.
Frequently Asked Technical & Procurement Questions
Does CipherMap replace SAST/SBOM tools or complement AI coding agents like Cursor and Claude Code?
Both patterns are supported. Many engineering teams start with CipherMap Tier A ($4,999/yr Standalone Auditor) alongside existing dependency SBOM tools specifically to generate signed CycloneDX 1.6 CBOMs across source, .jar/.whl bytecode, and .jks/.p12 keystores for CNSA 2.0, OMB M-23-02, PCI-DSS 4.0, or DORA audits. Teams upgrading to Tier B Enterprise Fleet ($9,999–$49,999/yr) consolidate 12-language IMM-* bug-class remediation and pair Cursor or Claude Code directly with ciphermap mcp over local stdio so AI-generated edits are verified locally with zero prompt egress.
Why can't a standard dependency SBOM tool (like Syft or Trivy) satisfy OMB M-23-02 or CNSA 2.0 CBOM requirements?
Package SBOM generators read lockfiles and container manifests—they can tell you OpenSSL, BouncyCastle, or Go stdlib crypto is installed, but not whether your application code invokes RSA-1024, SHA-1, 3DES-ECB, PKCS#1 v1.5, hardcoded keys, or finalized NIST FIPS 203 ML-KEM-768. CipherMap inspects 12-language ASTs, compiled .jar/.war/.whl constant pools, .jks/.p12 keystores, and ELF/Mach-O/PE symbols to populate CycloneDX 1.6 cryptoProperties at the exact call site.
How does CipherMap prevent broken builds or wire-breaking PQC changes when applying fixes?
CipherMap separates safe local API upgrades from wire-protocol migrations. Gate 2 PQC remediation (ciphermap fix --apply) and Tier B 4-Gate Immunity remediation (ciphermap immunity extinguish --apply) run inside isolated worktrees and network-denied OS sandboxes, verifying AST sink elimination, clean compilation, existing tests, and negative-witness checks—while refusing ambiguous or wire-breaking protocol edits via declined_protocol_guardrail.
How is CipherMap priced compared to traditional enterprise SAST vendors?
Free Discovery ($0) provides unmetered local PQC scanning and dry-run previews forever. Tier A Standalone Auditor is $4,999/yr (or $499/mo) for 1 scoped repository and 1 named auditor seat—under typical $5,000 corporate card limits and 100% credited toward an Annual Fleet upgrade within 30 days. Tier B Enterprise Fleet is $9,999/yr (up to 10 active contributors), $24,999/yr (up to 30), or $49,999/yr (up to 100) with $0 per-LOC fees, plus a 25% Founding Reference Partner rate lock on eligible annual agreements.
Test CipherMap Offline Free — Or Launch a $4,999 Single-Repo Fix Sprint
Download the SHA-256-verified native binary to inspect your own repo with zero egress, or start a Tier A Standalone Auditor sprint with 100% of your $4,999 credited toward an Annual Enterprise Fleet upgrade within 30 days.