CORRECTOVER
runtime verification · evidence infrastructure
Xiamen, CN · est. 2026
How it works Capabilities Evidence Pricing Blog Free Audit →
A second fuse, outside the agent · fail-closed by design

Your agents can call any tool. Correctover decides — before it runs — and proves what happened.

Every tool call is checked against parameter-level risk rules, then allowed or blocked with a signed receipt anyone can verify offline. Independent of the agent, independent of the model, fail-closed when things go wrong.

Request free audit or try the demo — 30 seconds, no signup
$ npm install correctover   ·   $ npx correctover-scan --demo
sub-ms
median decision, zero LLM calls
951/951
independent replay agreement
0
runtime dependencies
229,539
live tools in our census baseline

§1Authorize before. Verify after.

Logs being viewable is not the same as behavior being controllable. Correctover sits between your agent and its tools.

Interceptbefore execution
Tool name, arguments and context are checked against policy. SSRF, command injection, credential exfiltration and overprivilege are judged at the parameter level — intent, not keyword matching. Malformed calls fail closed.
Decidesame instant
The verdict is normalized (JCS / RFC 8785) and signed with Ed25519, then appended to a hash-chained ledger. Allow and block both produce receipts — silence is never an outcome.
Replayany time, by anyone
Predicates, canonical checkers and MUST-FAIL vectors are open. A third party can re-derive every allow/block decision without trusting us. Export to SIEM (ndjson / CEF / JSON) or anchor externally.
$ npx correctover-scan --demo
piped-installer  [CRITICAL] dangerous_command — curl -sSL https://example.com/install.sh | sh
leaky-keys  [HIGH] stdio_sensitive_env — OPENAI_API_KEY exposed
plaintext-remote  [HIGH] plaintext_http — http://internal.corp:9000/mcp
overprivileged  [CRITICAL] sudo bash -c 'rm -rf /tmp/cache && eval "$(curl …)"'
clean-server  ✓ No issues found
Summary: 2 CRITICAL · 3 HIGH across 5 servers

§2Why keyword scanners lose

Most tools match patterns. Correctover reads intent — the difference shows up as fewer false alarms and no blind spots.

Typical scanner
Correctover
exec() blocked everywhere — even inside code-execution engines where it is the product.
Context-aware: allowed in sandboxed exec engines, blocked in file-write tools.
Any curl to an API flagged as suspicious, breaking legitimate calls.
Destination-aware: public APIs pass; private and link-local ranges (169.254.169.254) blocked.
Webshell uploads slip through extension-only checks.
Content-aware: caught regardless of file type.
No trail — you can't prove what an agent did, or didn't do.
Every decision signed: allow or block, with a receipt a third party can replay.
Performance is stated qualitatively on purpose: the full path — rule verdict, Ed25519 signature, hash-chain append — runs well under a millisecond with zero LLM calls in the loop. Exact current figures move with hardware and load, so we publish the benchmark instead of a stale number: pip install agent-second-fuse && arg-fuse bench — run it yourself.

§3Evidence you can re-derive yourself

Trust is cheapest when it doesn't need to be extended. Everything below is public and independently checked.

Independent replay: 951/951 agreement.

A read-only re-implementer, built from the public specification alone, reached the same allow/block verdict on all 951 inputs. 51 MUST-FAIL vectors: zero false positives. 1,549 conformance checks and 66/66 consistency cases pass.

A census, not a sample.

We probed all 26,823 servers in the public MCP registry (13,089 open, 229,539 live tools measured, 25,143 high-consequence). Frozen 2026-10-12, DOI-archived, hash-manifested. See the Census Report.

Standards work, properly labeled.

Two individual Internet-Drafts (CCS runtime verification, now rev. 10; MCP parameter-risk, -01) and participation in the W3C Agent Conformance CG. Individual submissions — not RFCs, not IETF or W3C endorsement.

Zero dependencies, zero telemetry.

The runtime guard runs with no third-party packages and collects nothing. Your tool calls never leave your environment — the receipts stay yours.

§4Start free. Pay when you need proof.

The core SDK is free for evaluation and non-commercial use. Commercial tiers add the toolkit, the audit, and the census.

Tier
What you get
Price
Open corefree forever*
Full runtime guardrail SDK — command injection + SSRF blocking, credential exfiltration detection, CCS output validation, DSH plugin. Zero runtime dependencies. npm install correctover
*evaluation & non-commercial use
$0open sourceinstall →
Security kitproduction
Everything in open core, plus: MCP config scanner, commercial license, Ed25519 signed receipts in production, policy engine with custom rules, email support.
quoteper deploymentget quote →
Security auditper engagement
Professional audit of your MCP/agent infrastructure: configuration checks, SSRF / injection / credential analysis, compliance certificate, remediation guidance, signed audit report.
perengagementstart audit →
Census reportnew
The frozen ecosystem baseline: risk ranking across 13,089 open servers, your surface graded against the field. Three tiers — Standard, Custom (your surface graded item-by-item), and monthly Monitor. Rates on request.
rateson requestsee report →

Secure your agents in five minutes.

Install the guard, run the demo scan, or hand us your server list for the free snapshot audit — 48-hour turnaround, no code access needed.

Request free audit → Census report → npm install →