VirQaraUnder development

VirQara / Compliance Audit Engine

See the risk.
Decide what's next.

When agents outpace review, licensing risks and unchecked authority can slip through. VirQara helps close that gap. The Detection Licensing Auditor reads the YARA and Sigma rules you hold or are acquiring, matches each to the license that governs it, and reports what that license permits: internal use, hosted service, redistribution, modification. In development: AI Badge, a tool's authority approved once and enforced on every run.

AI moves fast. Control can't fall behind.

Detection Licensing AuditorAI Badge

Quaryn makes the boundary checkable

AI Badge tools are written in Quaryn, the language EdgeXene built. A tool declares its capability families at the top of one file, and the compiler checks that declaration across the whole reachable call graph. Undeclared or withheld families stop compilation. A helper cannot hide wider capability access, and the script cannot load native libraries to add new ones. Security engineers can review the declared boundary without tracing every helper. The runner adds a sandbox and resource ceilings the tool cannot change. The planned host policy covers approved operations and destinations.

Read the Quaryn guide

Evidence for the decision

Unknown stays unknown

Content whose license cannot be established is reported as unresolved. A gap remains a finding.

Capabilities are checked first

Quaryn rejects a tool that reaches an undeclared or withheld capability family, before it runs. The runner's sandbox narrows what the process can see.

The planned receipt includes refusals

The host design calls for signed receipts covering actions and refusals, with observed outcomes kept separate from inferred causes.

Two product lines. Two permission decisions.

See what a license permits. Set what an agent may do.

In development

Detection Licensing Auditor

See what each license permits.

The engine reads YARA and Sigma rules you hold or are evaluating for acquisition. It matches each rule to its governing license instrument and reports what that instrument permits. The engine exists. The service around it is not built.

  • Evaluate internal use, hosted or managed service, redistribution, and modification separately.
  • Trace each verdict to its license instrument. Inheritance alone does not produce a favorable verdict.
  • Keep unresolved licenses unresolved. Missing evidence does not produce a pass.
  • Match the report to the exact content examined through recorded hashes.
How it works
In development

AI Badge

Agents write the fix. You set the limits.

An AI writes a tool as one Quaryn file. Its header declares the capability families it uses. Approve a tool's authority once and it is enforced on every run, instead of reviewing every change the agent proposes. The runner is built and systematically tested with documented boundaries. The host for approvals, outbound actions, and signed receipts is designed and not built.

  • The compiler rejects capability use beyond the tool's declaration or the runner's grant.
  • The runner adds a sandbox, resource ceilings, a hard timeout, and an output limit.
  • The host design keeps outbound credentials with the host and limits actions to approved operations and destinations.
  • An approved policy may cover a new tool version only when the host can establish that the version stays within it. Wider authority requires fresh approval.
  • Signed receipts are part of the host design. They record requested actions, outcomes, and how execution ended.
How it works

The planned receipt

The host design calls for recording what was requested, what was allowed, and what was observed. Refusals belong in that record too. These are illustrative excerpts from the proposed design.

Example: permitted ticket transition
tool        ticket-closer
finding     [example finding]
action      ticket.transition to Resolved
outcome     success
evidence    [remote change identifier]
runner      observed exit 0; engine reported ok
signature   [host key and signature]
Example: refused ticket transition
tool        ticket-closer
finding     [example finding]
action      requested ticket.transition to Closed
outcome     denied
reason      Closed is outside the approved transition set
dispatch    nothing sent
signature   [host key and signature]

The runner produces execution reports today. The host that would perform these actions and sign these receipts is designed and not built. A ticket transition alone does not establish that a vulnerability was fixed.

Where this stands

Neither product line is generally available yet. Nothing on this site is for sale today.

The Detection Licensing Auditor engine exists. Its service is not built. The AI Badge runner is built and systematically tested with documented boundaries. Its approval, action, and receipt host is designed and not built.

If you evaluate detection content, or use agents to act on findings, we would like to hear how you work.

contact@edgexene.io

The report is an engineering analysis of license text and evidence. It is not legal advice and does not substitute for counsel.