Skip to content
View DSHCorrectover's full-sized avatar

Achievements

Achievement: Pull SharkAchievement: Quickdraw

Achievements

Achievement: Pull SharkAchievement: Quickdraw

Block or report DSHCorrectover

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
DSHCorrectover/README.md

Correctover — AI Reliability 🔬

Verifiable evidence infrastructure for AI agent security. Every claim we make ships as an Ed25519-signed receipt with a Bitcoin-anchored timestamp (OpenTimestamps). Don't trust — verify with one command.

Free weak-entropy check IETF draft-correctover-ccs npm: correctover-scan PyPI: ccs-verifier

What lives here

Tool What it does Verify it yourself
entropy.correctover.com Free weak-entropy lockfile check — runs 100% in your browser, nothing uploaded. Live weak-RNG watchlist over 600 high-traffic npm packages (163 flagged). Paste your package-lock.json, 30 seconds
correctover-scan (npm) Security scanner for MCP servers & AI agents — 18 checks mapped to OWASP AISVS, incl. weak-RNG fingerprints (CVE-2026-71851 crypto-js / CVE-2026-73567 jsbn). SARIF output. npx correctover-scan
ccs-verifier (npm · PyPI) One-command independent verification of CCS signed receipts — Ed25519 (RFC 8032) over canonical JSON + SPKI fingerprint. Zero dependencies. npx ccs-verifier verify receipt.json
ccs-conformance-vectors 66 signed conformance test vectors — reproducible by anyone clone & run

Standards work

  • draft-correctover-ccs (rev 10, Active) — fail-closed runtime verification + per-invocation cryptographic evidence for AI agents. Individual Internet-Draft; no IETF endorsement.
  • draft-correctover-gg-mcp-parameter-risk (rev 01) — byte-frozen parameter-risk baseline (benign FPR = 0 on dev split)
  • W3C interop submissions · Zenodo DOIs for methodology (10.5281/zenodo.21783723 et al.)

Field evidence (all reproducible)

  • SM2 zero-entropy key recovery — private key from public key + second-level timestamp alone; 5 third-party chain SDKs, black-box, 3/3 reproduced (demo)
  • AWS official MCP sandbox escape era (CVE-2026-115845): blacklist-style validation lost — runtime verification is the missing layer
  • 600-package weak-entropy watchlist: 163 flagged incl. wallet SDKs at millions of monthly downloads · Nov re-scan (correctover-scan v3.3.1): 100 top-traffic packages → 58 flagged, 59 critical files (ccxt, walletconnect stack, node-forge 150M/mo)

Contact

Guigui Wang — wangguigui@correctover.com · entropy.correctover.com

Popular repositories Loading

  1. agent-audit agent-audit Public

    Manual security audit service for AI agents and MCP integrations — semantic intent review of tool permissions, command injection, SSRF and credential-exposure paths, with a free 1-page audit summary.

    HTML

  2. ccs-conformance-vectors ccs-conformance-vectors Public

    Public conformance test vectors for CCS (Correctover Conformance Shape) — signed, tamper-evident receipt fixtures for verifying AI agent runtime security implementations.

    Python

  3. ccs-verifier ccs-verifier Public

    Moved to github.com/Correctover/ccs-verifier — CCS Runtime Verifier

  4. ccs-verifier-build ccs-verifier-build Public

    CI build matrix for ccs-verifier wheels (cp310-cp313, Linux/macOS/Windows)

    Python

  5. ccs-integrations ccs-integrations Public

    Framework-native adapters for CCS (Correctover Conformance Shape) cryptographically signed runtime receipts — Ed25519 + JCS signed audit evidence for AI agent tool calls (Pydantic AI, CrewAI).

    Python

  6. emilia-protocol emilia-protocol Public

    Forked from emiliaprotocol/emilia-protocol

    Authority control plane for autonomous work. EMILIA Gate enforces finite customer-owned mandates at protected executor boundaries; the open protocol keeps evidence verifiable.

    TypeScript