I publish as Artifex Ignotvs.
The seal carries a question mark. Before I trust a security claim, I want to know what was examined, how it was tested, and where the result stops being reliable. That is what I want to document here.
Quaere. Examina. Proba.
Ask. Examine. Test.
Most of the questions are quite practical. What can an agent launch with the configuration it has been given? Which files changed after a directory was copied? What can we establish from a saved web page?
This notebook will follow those questions through defensive security, digital forensics, OSINT, and agent configuration. A pseudonym gives the work a name. The evidence gives readers something to check.
There are four tools to start with:
- Limen MCP examines MCP configurations for risky launch commands, exposed credentials, and excessive container privileges. It performs static checks; enforcing permissions at runtime is outside its scope.
- Vallum HTTP reviews response headers, cookie flags, and transport and browser policies. Those findings describe the response being examined.
- Vestigium Integrity creates and compares SHA-256 directory manifests to make file changes visible.
- Lucerna OSINT inventories HTTP(S) references from saved HTML offline, keeping the source material close to the observations.
The limits are part of the work. A matching hash still leaves questions about who created the file and whether the baseline can be trusted. A link in a page gives us a recorded reference; identifying the person behind it would require other evidence.
I want the reports here to be small enough to reproduce. Each will state its scope, preserve the relevant artifacts, explain the steps, and distinguish observed results from assumptions. Where a finding needs a fix, the report should include a way to check that fix. Corrections belong alongside the original finding.
First on the list is a local file-integrity experiment: create a baseline, change a few synthetic files, compare the results, and examine what the comparison can actually establish.
If you find a weak assumption in one of the tools, bring a minimal example. Keep credentials and private evidence out of public issues.
The code, documentation, and tests are on GitHub.
Ex silentio, tutela.
Top comments (0)