# CipherMap

> CipherMap (`v1.0.0`, by Ciphermap Technologies LLC) is a local, offline-first post-quantum cryptography (PQC) vulnerability scanner, CycloneDX 1.6 Cryptographic Bill of Materials (CBOM) & Immunity Bill of Materials (IBOM) generator, 12-language `IMM-*` bug-class extinction engine (4-Gate Vericoding), and local `stdio` MCP AI agent referee.

CipherMap runs on developer workstations, IDE coding agents, and self-hosted CI/CD runners (`--offline --no-telemetry`) with zero source-code egress. It inspects 12 languages (Go, Python, JavaScript/TypeScript, Java, Kotlin, C#, Rust, C/C++, Ruby, PHP, Swift), JVM/Python archives (`.jar`, `.war`, `.ear`, `.whl`), `.jks`/`.p12` keystores, ELF/Mach-O/PE binaries, PKCS#11 HSM calls, and IaC manifests against NIST FIPS 203 (`ML-KEM`), FIPS 204 (`ML-DSA`), FIPS 205 (`SLH-DSA`), NSA CNSA 2.0, White House OMB M-23-02, FIPS 140-3, CMMC 2.0, PCI-DSS 4.0, EU DORA, BSI TR-02102-1, ANSSI hybrid PQC guidance, and CISA Secure-by-Design defect classes.

## Commercial Tiers & Entitlement Scope

- **Free Discovery (`$0`):** Unlicensed local `ciphermap scan`, `ciphermap preflight` (`-f/--format text|json`, `-o/--output`, `--exclude-vendored`), `ciphermap fix --dry-run` PQC previews, `ciphermap demo`, offline proof/IBOM verification (`immunity extinguish --verify-proof`, `immunity attest --verify`), `ciphermap verify`, and `ciphermap herd-immunity` (`preview`, `list`, `share`).
- **Tier A — Standalone Auditor (`$4,999/yr` or `$499/mo`, plus 7-Day Pro Trial at `/beta`):** 1 named auditor seat · unlimited local/offline PQC assessments, deterministic CycloneDX 1.6 CBOM (`ciphermap cbom` + `--diff`), composite `Ed25519 + ML-DSA-65` (`.pqc.sig`) signed audit reports (`ciphermap report`), regulatory compliance profiles, and Gate 2 compiler-verified PQC source patches (`ciphermap fix --apply`).
- **Tier B — Enterprise Fleet (`$9,999/yr` up to 10 contributors, `$24,999/yr` up to 30, `$49,999/yr` up to 100):** Includes everything in Tier A plus 12-language `IMM-*` bug-class detection (`ciphermap immunity scan`), 4-Gate Vericoding remediation (`ciphermap immunity extinguish --apply --proof-out`), CycloneDX 1.6 CISA IBOM & OpenVEX 0.2.0 attestation (`ciphermap immunity attest`), monotonic CI regression ratchets (`ciphermap immunity ratchet --init` / `--advance` / `--evaluate`), `.cursor/rules` & `CLAUDE.md` policy generation (`ciphermap immunity emit-agent-rules --write`), local `stdio` JSON-RPC 2.0 MCP referee (`ciphermap mcp --workspace .` exposing `ciphermap_scan_all`, `ciphermap_inspect_rule`, `ciphermap_verify_candidate_fix`, and `ciphermap_verify_workspace_clean`), PR inline gates (`ciphermap ci-review --domain all`), and the self-hosted CISO Web Console (`ciphermap server`).

## Primary Documentation & Evaluation Pages

- [Full Technical Specification (`/llms-full.txt`)](https://www.ciphermap.io/llms-full.txt): Single-file comprehensive reference covering CLI commands, exit codes, CycloneDX 1.6 CBOM/IBOM JSON structure, regulatory profiles, 832-repository benchmark metrics, MCP tools, and commercial bands.
- [Homepage](https://www.ciphermap.io/): Overview of single-pass local PQC discovery, signed CBOM/IBOM provenance, 4-Gate `IMM-*` bug-class extinction, and local MCP agent verification.
- [Technical Comparison (`/compare`)](https://www.ciphermap.io/compare): Side-by-side matrix comparing CipherMap against cloud SAST scanners, package-only SBOM tools, and standalone AI coding agents.
- [Federal & Defense Mandate Guide (`/federal-mandate`)](https://www.ciphermap.io/federal-mandate): Offline OMB M-23-02, NIST IR 8547, and NSA CNSA 2.0 (Jan 1, 2027) compliance and signed CBOM workflows.
- [Role Guides (`/for-developers`, `/for-teams`, `/for-executives`, `/for-enterprise`)](https://www.ciphermap.io/for-enterprise): Dedicated technical and ROI guides for Principal Developers, AppSec/Platform Teams, CISOs/CTOs, and Regulated Enterprises.
- [Evaluation Pack (`/eval-pack`)](https://www.ciphermap.io/eval-pack): Native Apple Developer ID (`ZLF7244KA7`) and Microsoft Authenticode signed macOS, Linux, and Windows CLI bundles (`arm64` and `x64`) with SHA-256 checksums and a synthetic multi-language `sample-vault` fixture.
- [CLI Documentation (`/docs`)](https://www.ciphermap.io/docs): Complete `v1.0.0` command reference (`scan`, `preflight`, `cbom`, `report`, `fix`, `verify`, `immunity` [`scan`, `extinguish`, `attest`, `ratchet`, `emit-agent-rules`], `mcp`, `herd-immunity`, `ci-review`, `server`, `lsp`), exit codes (`0` clean, `1` blocking policy findings, `2` incomplete coverage or usage/config failure), offline license contract, and remediation boundaries.
- [Detection Rules Catalog (`/docs` & `/docs/rules/*`)](https://www.ciphermap.io/docs): 101+ cryptographic `PQC-*` rules (including pre-standard Round 3 Kyber/Dilithium `PQC-PRE-001..005`, HSM PKCS#11 `PQC-HSM-*`, banking 3DES DUKPT `PQC-BANK-001`) plus the 6 Tier B Enterprise `IMM-*` bug-class extinction families across 12 languages: `IMM-BOUND-001` (unbounded stream/payload allocation, `CWE-770`), `IMM-PATH-001` (unjailed filesystem path traversal, `CWE-22`), `IMM-SQLI-001` (dynamic SQL interpolation/concatenation, `CWE-89`), `IMM-CMD-001` (dynamic shell command execution, `CWE-78`), `IMM-DESER-001` (unsafe polymorphic deserialization / permissive decoding, `CWE-502` / `CWE-20`), and `IMM-AUTH-001` (unauthenticated state-mutating boundary / Server Action, `CWE-306`, `AutoExtinguish: false` · MCP Referee).
- [CI/CD & Coding-Agent Integrations (`/integrations`)](https://www.ciphermap.io/integrations): GitHub Actions, GitLab CI, Jenkins, Azure DevOps, Bitbucket Pipelines, local `ciphermap mcp` configuration (`ciphermap_scan_all`, `ciphermap_inspect_rule`, `ciphermap_verify_candidate_fix`, `ciphermap_verify_workspace_clean`) for Claude Code/Cursor/Windsurf, and `emit-agent-rules` guardrails.
- [Pricing & Commercial Plans (`/pricing`)](https://www.ciphermap.io/pricing): Transparent Free, Tier A Standalone Auditor, and Tier B Enterprise Fleet pricing with self-serve checkout and enterprise order forms.
- [7-Day Pro Trial (`/beta`)](https://www.ciphermap.io/beta): No-card 7-day Tier A evaluation key for generating signed CycloneDX 1.6 CBOMs and regulatory exports on one repository, plus guided Tier B Enterprise pilots.
- [Enterprise & Regulated Sectors (`/enterprise`)](https://www.ciphermap.io/enterprise): Self-hosted CISO Web Console (`ciphermap server`), Tier B 4-Gate `IMM-*` governance, 12-language hybrid `X25519 + ML-KEM-768` sidecar codegen, zero-PII `PRF_seat` contributor nullifiers, and interactive deal configurator.
- [Sample Audit Evidence (`/evidence`)](https://www.ciphermap.io/evidence): Inspectable CycloneDX 1.6 CBOM, SARIF 2.1.0, composite `Ed25519 + ML-DSA-65` (`.pqc.sig`) verification workflows, and illustrative Tier B IBOM / 4-Gate `ProofBundle` previews.
- [Methodology & Boundaries (`/methodology`)](https://www.ciphermap.io/methodology): Static analysis scope, fail-closed `coverage_status` (`complete` vs `incomplete`), Gate 2 PQC & 4-Gate Immunity verification, and `declined_protocol_guardrail` safety refusals.
- [Security & Data Handling (`/security`)](https://www.ciphermap.io/security): Zero-egress offline boundary (`--offline --no-telemetry`), network-denied OS witness sandboxes (`sandbox-exec` / `unshare -Urn`), local `stdio` MCP isolation, zero-code 12-token AST `herd-immunity` receipts, and coordinated vulnerability disclosure (`security@ciphermap.io`).

## How CipherMap Differs from Generic SAST, SBOM Scanners, and AI Coding Agents

1. **Zero Source Egress:** Runs 100% locally (`--offline --no-telemetry` and `stdio` MCP); source code, keys, and HSM call sites are never sent to SaaS scanners or cloud LLM context windows.
2. **Binary, Archive & Keystore Depth + Fail-Closed Coverage:** Inspects `.jar`/`.war`/`.whl` constant pools, `.jks`/`.p12` keystores, and ELF/Mach-O/PE symbols, exiting `2` (`coverage_status: incomplete`) on corrupted or unparseable artifacts rather than silently reporting clean grades.
3. **Standards-Pinned FIPS 203/204/205 Rules:** Distinguishes finalized NIST FIPS 203/204/205 parameters from wire-incompatible Round 3 `kyber768`/`dilithium3` drafts (`PQC-PRE-001..005`) often hallucinated by LLMs.
4. **4-Gate Compiler & Sandbox-Verified Remediation:** Validates candidate fixes against AST/taint elimination, clean compilation, existing repository tests, and (in Tier B Immunity) a network-isolated negative-witness exploit test—refusing unsafe or wire-breaking edits (`declined_protocol_guardrail`).
5. **Cryptographically Signed CBOM & IBOM Provenance:** Produces deterministic CycloneDX 1.6 CBOMs, `cbom --diff` deltas, CISA IBOM / `ProofBundle` attestations, and executive HTML reports sealed with composite `Ed25519 + ML-DSA-65` (`.pqc.sig`) signatures.