Juliogomez Foundry

This repo is a proof of concept. It implements the Foundry security harness specification and demonstrates it against multiple real targets: Langflow (governance thesis), MLflow (scale validation), and PyGoat (Antares integration demo).

Foundry is a governance and repeatability layer over the model you already trust . It does not make the model smarter, it makes the output verifiable, tiered, auditable, bounded, repeatable, and self-improving . The same model, wrapped in the harness, produces findings a security program can build a process on. Without it, you get an answer you have to trust on faith.

The full thesis and the evidence behind it: VALUE.md .

The integrated security loop: Antares + Foundry + CodeGuard

Foundry is one part of a larger loop where three Cisco-originated projects each address a different phase of the security lifecycle:

Each detection dollar spent once compounds into prevention everywhere, forever. The codeguard-* rules governing this very workspace are the same format, the loop is already in operation.

Deep dive: CODEGUARD.md and LOCALIZER.md .

Governance thesis (Langflow). The PoC evaluates the entire Langflow v1 API surface (289 function-level units, 25 modules). Foundry surfaces roughly 2x the confirmed findings of a fair baseline agent (same model, same code, disciplined prompt) at ~10x the token cost. Two runs collapse to the same distinct fingerprints instead of producing two unrelated walls of text. The difference is not insight; it is governance.

Second codebase (MLflow). To check that Foundry isn't tailored to Langflow, we ran it on MLflow v2.9.0, a different and larger project (830 functions, 3x Langflow's 289). We only changed the config file to point to the new repo, but the engine code stayed the same. The evidence gate, the declared stop under the token cap, and the per-finding audit trail all behaved the same way.

Antares integration (PyGoat). The end-to-end proof of Antares + Foundry localize : Antares identifies the file affected by CWE-78 (shell injection) in 22 seconds at zero cost (local model). Foundry then runs all 13 rules on the narrowed scope, finding 23 true-positives — including the targeted CWE-78 plus adjacent weaknesses in the same area — using 30% fewer tokens than a full sweep.

Prevention experiment (CodeGuard). A blind A/B test of whether the rules change what an AI agent writes. Across 72 agent sessions, the agent wrote the target weakness 5 times out of 24 with no rules and 4 out of 24 with CodeGuard's core rules, but 0 out of 24 with the rules Foundry synthesized added. See PREVENTION.md .

Numbers and methodology: RESULTS.md and METHODOLOGY.md .

What is inside the repo

LLM calls go through the Cursor SDK using your Cursor plan. You authenticate with a CURSOR_API_KEY from Cursor Dashboard. No secrets are written to disk. Without a key, everything works in "FOUNDRY_LLM=mock" mode for offline validation.

The baseline receives the same model with a disciplined prompt that asks for the same rigor. I do not weaken it on purpose. Whatever the run produces is what the docs report, including where the harness did not help. See METHODOLOGY.md .