Enterprises are handing real work — and real budgets — to autonomous agents. An agent that issues refunds, moves funds, or touches customer data is only as safe as its weakest prompt. Knowing the odds for the population of agents isn't the same as knowing your agent.

PharosOne is the neutral third party for agent trust. You run our open-core engine against your exact configuration — a live corpus of prompt injection, tool abuse, system-prompt extraction, and data leakage. It runs where your agent and secrets already are. Then, when you need to prove it to a risk committee, our server turns your findings into a signed, audit-ready certificate — without ever seeing your data. Independence proven by architecture, not just position.

The default tier is offline: no API key, no network, no Docker.

# Install the onboarding skills into any Agent Skills–compatible project
npx skills add pharosone/pharosone

Or run the engine directly:

git clone https://github.com/pharosone/pharosone
cd pharosone
uv sync --extra dev                                   # or: pip install -e ".[dev]"

uv run probe-engine run --corpus examples/corpus --tier mock --out findings.json

You get a self-contained findings.json: a per-probe attack-success rate (ASR) with a Wilson 95% confidence interval and an honest verdict — pass / fail / unverified / insufficient_power. Real testing against your agent is opt-in via --tier model (a synthetic agent on a real LLM) or --tier bridge (your real external agent over HTTP or a Python adapter).

For high-stakes deployments, our offensive team also audits your agent by hand — chaining attacks a corpus can't and writing the report your risk committee will defend — and runs traditional penetration tests for organisations that don't have AI agents yet. Book an audit →

corpus → selection → variation → compile → Inspect eval → oracle → judge → aggregate → findings

• Probes are data, not code — each attack is a versioned YAML spec (intent, scenario, delivery channel, required capabilities, and an oracle). New attack = new YAML; the engine never changes.
• Selection is an execution gate — a probe whose channel or capability your agent doesn't declare is surfaced as a blind spot, never silently counted as robust.
• Variation mutates and paraphrases each seed in the agent's own domain and language (EN/RU deterministic frames + LLM paraphrase for any other language), so coverage never rests on one fragile string.
• Judge-adjudicated verdicts — false-positive-prone oracles degrade loudly to unverified rather than a silent pass.

Built on Inspect AI. See the Probe Engine README for the full architecture.

AIUC-1 · ISO/IEC 42001 · EU AI Act · NIST AI RMF · OWASP Agentic Top 10

Every report is audit-ready for the committees your stakeholders already trust.

The full proprietary corpus, the AIUC-1 crosswalk, the report-to-standard mapping, and certificate issuance are delivered by the PharosOne server — not part of any public repository.

We publish our standards work and empirical findings in the open at pharosone.ai/research:

• The PharosOne Probe Engine: architecture of a behavioral scanner for AI agents
• Attack-variation policies and LLM-judged scoring: an empirical study
• AIUC-1: the SOC 2 for AI agents
• ISO/IEC 42001: a management system for AI
• The EU AI Act: from legal obligation to evidence
• NIST AI RMF: governing risk, measuring trust

• Your secrets never move. API keys and system prompts are in-memory for the run only — never written to disk or logs, never uploaded.
• Transcripts never leave. At certification, only stats-only evidence (ASR, counters) is uploaded, Ed25519-signed. WireEvidence has no transcript field by construction — the proof conversation physically cannot be sent.
• The cert is still independent. The server maps your findings and signs the report without ever seeing your data. We don't build agents — and it's the architecture, not just our position, that makes the result neutral.

Found a vulnerability? See SECURITY.md.