Skip to main content
Founding Partner + 7-Day Trial
Offer
CI, MCP AI REFEREE, LSP & FLEET INTEGRATIONS

Connect PQC & Immunity evidence to CI, AI coding agents, and your fleet.

Start with local SARIF and CI gates. Tier B Enterprise adds a 100% local ciphermap mcp AI referee for Claude Code, Cursor, and Windsurf plus PR bots and fleet routing. Provider adapters have local contract tests, with live-service validation still pending. Each card shows its current status, starting command, credential scope, and failure behavior.

1. Free CI Gate
SARIF 2.1.0 & --fail-on

Exit-code gating, pre-commit hooks, and CI templates with zero license secret.

2. Local MCP Referee
Claude Code · Cursor · Windsurf

Zero-egress stdio MCP server + .cursor/rules & CLAUDE.md guardrails (Tier B).

3. In-Place PR Bots
GitHub · GitLab · Azure · Bitbucket

Updates comments in place across PQC + IMM-* domains (--domain all).

4. Issue & SIEM Routing
Jira · Slack · OTLP · Dep-Track

Fingerprint-deduplicated Jira tickets, 800 ms OTLP budget, and CBOM push.

5. Self-Hosted Fleet
ciphermap server & /metrics

Single-tenant CISO console, Prometheus scrape endpoint, and SVG repo badges.

SARIF + CI fail gate

Free Discovery

Free SARIF 2.1.0 output with stable fingerprints, rule metadata, and tool-notification records. Keep upload and policy separate from the free --fail-on exit-code gate so finding delivery cannot change the scan verdict.

Validation status: SARIF structure and exit-code contracts are tested; live code-scanning validation is pending.

Starting command / configuration
ciphermap scan . --format sarif -o results.sarif
Credential scope & build-failure policy
Credential Scope
None for CipherMap; the workflow's upload step needs security-events: write.
Fails the build?
No — the gate is --fail-on's exit code, kept separate on purpose.

CI/CD templates, Action + pre-commit

Free Discovery

Generated templates for GitHub Actions, GitLab CI, Jenkins, Azure Pipelines and Bitbucket Pipelines, plus a composite GitHub Action and pre-commit hook.

Validation status: Templates are implemented; public Action/pre-commit publication and live-provider validation are pending.

Starting command / configuration
ciphermap init --ci github
Credential scope & build-failure policy
Credential Scope
security-events: write for the SARIF upload; a license secret only for paid profiles.
Fails the build?
Yes, by design — that is the point of a gate.

Editor diagnostics + hover guidance

Free diagnostics · gated apply

Run the local language server for supported diagnostics and hover guidance. Base diagnostics are Free; paid compliance profiles keep their own entitlement. Scoped apply is a separate gated capability, not an automatic consequence of receiving a diagnostic.

Validation status: Check your build's supported scope. A diagnostic or hover result is not evidence that a source rewrite can be applied or that application tests passed.

Starting command / configuration
ciphermap lsp
Credential scope & build-failure policy
Credential Scope
No license for base diagnostics. Scoped apply requires an eligible build and platform, commercial entitlement, trusted-workspace verifier consent, a saved supported candidate, and Gate 2 checks.
Fails the build?
Not a CI gate. Use scan --fail-on for blocking CI policy.

SonarQube (via SARIF)

Free Discovery (SARIF export)

sonar.sarifReportPaths ingests our SARIF with no custom exporter required. Structural conformance to SonarQube's documented import contract is pinned by test.

Validation status: Structural contract tested; live SonarQube ingestion has not been exercised.

Starting command / configuration
sonar-scanner -Dsonar.sarifReportPaths=ciphermap.sarif
Credential scope & build-failure policy
Credential Scope
Your scanner's own.
Fails the build?
No.

Local MCP AI Referee (Claude Code, Cursor, Windsurf)

DevSecOps Enterprise · Tier B

Runs a 100% local Model Context Protocol (MCP) JSON-RPC 2.0 server over stdio exposing 4 deterministic tools: ciphermap_scan_all, ciphermap_inspect_rule, ciphermap_verify_candidate_fix, and ciphermap_verify_workspace_clean. Rejects unverified AI-generated patches when AST, compiler, or network-denied witness gates fail.

Validation status: JSON-RPC 2.0 stdio protocol and 4-tool contracts are tested locally; editor-host behavior depends on client version.

Starting command / configuration
ciphermap mcp --workspace .
Credential scope & build-failure policy
Credential Scope
Zero external API keys or open sockets; runs locally over stdio. Requires a Tier B Enterprise Fleet license key (CIPHERMAP_LICENSE or ~/.config/ciphermap/config.json).
Fails the build?
Not a CI step; returns structured MCP tool-call rejection payloads inside the local IDE session.

Agent Policy Guardrails (.cursor/rules & CLAUDE.md)

DevSecOps Enterprise · Tier B

Synthesizes repository-native Cursor rulepacks (.cursor/rules/ciphermap-immunity.mdc) and Claude Code instructions (CLAUDE.md) from your active IMM-* findings and monotonic immunity ratchet so coding agents invoke the local MCP referee before returning code.

Validation status: Deterministic rulepack generation is tested locally; agent adherence depends on the host LLM and CI ratchet enforcement.

Starting command / configuration
ciphermap immunity emit-agent-rules . --write
Credential scope & build-failure policy
Credential Scope
No external service token; writes local Markdown/MDC instruction files into the repository under Tier B Enterprise entitlement.
Fails the build?
No — pair with ciphermap immunity ratchet . --evaluate and ciphermap ci-review --domain all in CI to enforce blocking policy.

GitHub pull-request review

DevSecOps Enterprise · Tier B

Ranked PQC and IMM-* findings summary, 12-language NIST FIPS 203 (ML-KEM-768) / FIPS 204 (ML-DSA-65) migration blueprints, and optional 4-Gate ProofBundle summaries (--domain crypto|immunity|all --proof) posted as a PR comment and updated in place on later runs. A check run adds inline annotations chunked to GitHub's 50-annotation limit.

Validation status: Implemented; live GitHub validation is pending.

Starting command / configuration
ciphermap ci-review --provider github --domain all
Credential scope & build-failure policy
Credential Scope
GITHUB_TOKEN with pull-requests: write, plus checks: write for annotations. A 403 names the missing permission in the error.
Fails the build?
Provider and command errors exit nonzero. Findings alone fail only when blocking mode's severity gate trips.

GitLab merge-request note

DevSecOps Enterprise · Tier B

Ranked PQC and IMM-* findings (--domain crypto|immunity|all) and 12-language remediation blueprints posted as an MR note, updated in place on subsequent pipeline runs.

Validation status: Implemented; live GitLab validation is pending.

Starting command / configuration
ciphermap ci-review --provider gitlab --domain all
Credential scope & build-failure policy
Credential Scope
Token with the api scope, Developer role or above. The job token is not used because it cannot post MR notes.
Fails the build?
Provider and command errors exit nonzero. Findings alone fail only when blocking mode's severity gate trips.

Azure DevOps PR thread

DevSecOps Enterprise · Tier B

Summary posted as a PR thread, updated in place and created in closed state so active threads do not block PR completion under branch policies.

Validation status: Implemented; live Azure DevOps validation is pending.

Starting command / configuration
ciphermap ci-review --provider azure
Credential scope & build-failure policy
Credential Scope
PAT with Code (Read & Write), or the pipeline's $(System.AccessToken).
Fails the build?
Provider and command errors exit nonzero. Findings alone fail only when blocking mode's severity gate trips.

Bitbucket Cloud PR comment

DevSecOps Enterprise · Tier B

Summary posted as a PR comment and updated in place on Bitbucket Cloud pipelines.

Validation status: Implemented for Bitbucket Cloud; live-provider validation is pending.

Starting command / configuration
ciphermap ci-review --provider bitbucket
Credential scope & build-failure policy
Credential Scope
Access token with pullrequest:write, or username:app-password.
Fails the build?
Provider and command errors exit nonzero. Findings alone fail only when blocking mode's severity gate trips.

Jira ticket lifecycle

DevSecOps Enterprise · Tier B

Creates a ticket per new finding with 12-language NIST FIPS 203/204 migration blueprints, skips open tickets, and supports automated closure (--resolve-remediated) when findings are fixed.

Validation status: Implemented; live Jira Cloud and Data Center validation is pending.

Starting command / configuration
ciphermap jira . --jira-url <url> --jira-project SEC
Credential scope & build-failure policy
Credential Scope
Cloud: email + API token. Data Center: a PAT.
Fails the build?
Command or synchronization errors exit nonzero; finding presence alone is not a build gate.

Slack alerts

DevSecOps Enterprise · Tier B

Sends a Block Kit summary card to an incoming webhook, filtered by a configured severity threshold.

Validation status: Implemented; live Slack delivery validation is pending.

Starting command / configuration
ciphermap scan . --webhook-url <url> --webhook-on high
Credential scope & build-failure policy
Credential Scope
The webhook URL is the credential; CipherMap redacts it from every error it prints.
Fails the build?
No — a notification failing should not fail a build.

OpenTelemetry (OTLP/HTTP)

DevSecOps Enterprise · Tier B

Exports scan logs and metrics as OTLP JSON verified against the collector's unmarshaller. A slow collector can delay a scan by at most the 800 ms delivery budget.

Validation status: Collector payload contract is tested; the supported collector matrix has not yet been exercised live.

Starting command / configuration
CIPHERMAP_OTEL_ENDPOINT=http://collector:4318
Credential scope & build-failure policy
Credential Scope
OTEL_EXPORTER_OTLP_HEADERS standard environment variable.
Fails the build?
No.

Dependency-Track

DevSecOps Enterprise · Tier B

Uploads CycloneDX 1.6 CBOMs directly to /api/v1/bom. Non-CycloneDX formats are refused locally before any network call.

Validation status: Implemented; live Dependency-Track validation is pending.

Starting command / configuration
ciphermap cbom . --push-url <url> --api-key <key> --project-id <uuid>
Credential scope & build-failure policy
Credential Scope
X-Api-Key with BOM upload permission.
Fails the build?
Yes, on error — a compliance artifact that failed to land must be visible.

Prometheus + CISO Fleet Server

DevSecOps Enterprise · Tier B

Self-hosted ciphermap server exposes /metrics (readiness score, scans processed, repos monitored), a 6-tab CISO Web Console, and per-repo SVG readiness badges.

Validation status: Packaged beta on macOS and Linux; Windows and multi-node operational validation are pending.

Starting command / configuration
ciphermap server
Credential scope & build-failure policy
Credential Scope
Server-only ingest signing key; repository-scoped CI write tokens; admin bearer token for /metrics. Minting an ingest token is a separate administrative command that exits after printing the token; it does not start the server.
Fails the build?
n/a
Tier B Enterprise · Zero-Egress AI Coding Agent Setup

Wire Claude Code, Cursor, or Windsurf to ciphermap mcp

Give local AI coding agents a deterministic verification loop without streaming repository code to an external scanner API. Pair the stdio MCP server with generated repository rules and a blocking CI ratchet.

Full MCP tool reference →
1. .mcp.json / .cursor/mcp.json / windsurf mcp_config.json
{
  "mcpServers": {
    "ciphermap": {
      "command": "ciphermap",
      "args": ["mcp", "--workspace", "."]
    }
  }
}
2. Emit Repository Agent Rules + Lock CI Ratchet
# Write .cursor/rules/ciphermap-immunity.mdc & CLAUDE.md
ciphermap immunity emit-agent-rules . --write

# Lock extinguished IMM-* classes in git & enforce in CI
ciphermap immunity ratchet . --init --stage stage_1_diff_extinct
ciphermap immunity ratchet . --evaluate

Third-party SIEM & ticketing routing FAQ

How to route findings into Splunk, Datadog, Sentinel, QRadar, ServiceNow, and PagerDuty

Splunk · Datadog · Elastic · New Relic

No bundled vendor-specific connector. OTLP export can feed an OpenTelemetry Collector; validate your collector exporter, destination schema, and credentials before relying on onward delivery.

Microsoft Sentinel · IBM QRadar

No bundled connector. A customer-managed collector or adapter must translate and deliver the evidence into your destination; that end-to-end route has not been validated by CipherMap.

ServiceNow

CipherMap exports CycloneDX, SARIF, and OpenVEX, but does not ship a ServiceNow connector. Confirm the importer, schema mapping, and required ServiceNow product with your administrator.

PagerDuty

A cryptographic inventory finding is not a 3 AM pageable incident. Route alerts to Slack and escalate from there if desired.

Snyk

CipherMap does not currently ship a Snyk connector. Use the exported artifacts alongside your existing application-security workflow.

Test our CI gate and SARIF output locally today

Access boundary: Free Discovery includes local scanning, SARIF 2.1.0, and the deterministic CI exit-code gate. Tier A evidence and Tier B provider workflows require the appropriate commercial entitlement; read the CI setup guide or compare pricing.

Download CipherMap CLI (.zip)Claim 7-Day Free Pro Trial Key