Trust, earnedand proven.
Before a coding agent is trusted with your repo, Umbra tests whether it can be trusted in your repo — and grants only the authority it earns.
Umbra decides how much authority each change has earned.
An executable contract bounds the change · untrusted repo text is quarantined · an independent verifier the writer can't bypass checks it · only the authority it earns is granted · sealed in an Ed25519-signed receipt. It never merges.
For the platform & security lead rolling out Codex across dozens of repos who has to prove the agent stayed in bounds.
Or run a live scan on a public repo
The Agent Admission Test
Test the agent before you trust it with your repo.
“AI finds a CVE and opens a PR” is a crowded category. Umbra’s wedge is one layer up: one governed, deterministic pipeline runs before any PR and decides whether a change is even allowed — then grants only the authority it earns.
Earned-authority passport
Authority is earned per run, and revocable.
Bound to the exact run (receipt hash, base commit, executor + Codex config hash), 7-day expiry. A server-side Emergency Brake forces Level 0 — and the PR route refuses to open a PR for a repo that’s revoked, below L2, or expired. auto_merge is false at every level.
Caught in the act
A fix that didn’t actually fix it.
Umbra once opened a bump — next 14.2.5 → 14.2.7 “to remediate GHSA-h25m-26qc-wcjf.” But 14.2.7 is still inside that advisory’s vulnerable range. The independent verifier is now CVE-aware: it reads the produced manifest and confirms the bump actually clears the named advisory (real fix: 15.0.8) — and regenerates the lockfile.
Umbra never claims a remediation it can’t stand behind.
Why it isn’t just glue over existing tools
Capability comparison
typical/default behaviour per category · products evolve
| Capability | Review bots | Dependency bots | Coding agents | Umbra |
|---|---|---|---|---|
| Comments / reviews a change | ✓ | — | ◐ | ✓ |
| Opens dependency-fix PRs | — | ✓ | ✓ | ✓ |
| Decides if the agent is allowed to change (fail-closed contract) | — | — | — | ✓ |
| Quarantines prompt-injection on disk before the run | — | — | — | ✓ |
| Independent verifier the writer can't bypass | ◐ | — | — | ✓ |
| Verifies the bump actually clears the cited CVE | — | ◐ | — | ✓ |
| Earned, revocable, run-bound authority (L0/L1/L2) | — | — | — | ✓ |
| Ed25519-signed, independently verifiable receipt | — | — | — | ✓ |
| Never auto-merges | ◐ | ◐ | ◐ | ✓ |
✓ does this · ◐ partial · — different scope (not a shortcoming). Basis: OWASP Top 10 for LLM Apps 2025 (LLM01, LLM06) and each product’s public docs.
Why now: teams are adopting coding agents (Codex, Claude Code, Devin) across their repos today — and the two risks Umbra is built to contain are named in the OWASP Top 10 for LLM Apps (2025). There is no repeatable way to prove an agent stayed in bounds. Umbra is that proof.
Run the Admission demo →The Evidence Locker
One night. One repo. Every receipt.
Every captured shift opens to the full chain — OSV advisories, the Codex diff, the provider ledger, and the earned authority level, plus an exportable Evidence Pack (stamped with a recomputable SHA-256 integrity hash) and a signature-verifiable, Ed25519-signed Remediation Receipt.
Bounded specialists, one shift.
Specialists on shift
Specialist 1 of 6: Watchman
Evidence · last nightSample
What Umbra found last night.
A representative finding — a sample of the real output shapes: an OSV advisory, a commit from git blame, a proposed patch. Reasoned by OpenAI, grounded in your repo, never invented. Run your own scan to see live labels.
Open redirect via malformed URL in Express
- Affected
- express@4.17.1
- Detected by
- ◉ WATCHMAN · via OSV.dev advisories
- Root cause
- commit a9c31f · “refactor static serving”
- Fix
- → upgrade to express@4.19.2
⌁ DETECTIVE traced 500s on /checkout to one commit — reasoned over real git history, not guessed.
3 days ago · @dev
◈ REVIEWER scored the fix: blast-radius low · safe to merge.
The night crew
Specialists on station. Every change still governed.
Open the file on each. They investigate and prepare work — but nothing reaches your repo without passing the contract, the verifier, and you.
Hunts known CVEs across every resolved dependency, live against OSV.dev advisories. Never sleeps.
Agent 1 of 5: Watchman, Dependency sentinel
Hunts known CVEs across every resolved dependency, live against OSV.dev advisories. Never sleeps.
The night shift · six stationscaptured · calhacks-12
One night, start to sunrise.
Scroll a single real shift end to end — from the first OSV lookup to the diff Codex left for review. Nothing here is staged: every advisory, provider label and diff line is replayed from a genuine captured run.
- 02:00Scan
- 02:45Triage
- 03:30Root cause
- 04:10Draft fix
- 04:45Evidence
- 05:15Human gate
- 02:00Scan
- 02:45Triage
- 03:30Root cause
- 04:10Draft fix
- 04:45Evidence
- 05:15Human gate
How OpenAI is used
Built on Codex and GPT reasoning.
Four moving parts, each labelled with what produced it — so you always know when a result is live, cached, or unavailable.
Codex CLI
codex-cliProposes code diffs inside a disposable clone with no origin remote. Write credentials are never handed to the Codex process.
GPT‑5.6 reasoning
gpt‑5.6Explains blast-radius, root cause, and PR risk over real repo evidence — when live reasoning is enabled for your account.
Responses streaming
responses-api-streamAsk Umbra streams grounded answers token-by-token, each backed by a real file:line reference — never invented.
Provider ledger
provider ledgerEvery output carries its source: live, cache, demo, or unavailable. Honesty is a first-class feature, not an afterthought.
Where this goes next
From a draft you check to a fix you ship.
Umbra already works in a disposable checkout and verifies before it hands you anything. Here’s what runs today — and the next step that turns each agent from a junior into a senior.
Contract-declared checks
Today
Runs the contract's required checks (allowlisted profiles, secret-stripped env) on the base commit and the changed tree, capping authority when they don't pass.
Next
Broader check profiles and richer per-check provenance in the signed receipt.
Proactive incidents
Today
Paste an error and the Detective traces it to a root-cause commit.
Next
Sentry / Datadog webhooks trigger the investigation before you even notice.
Grounded at scale
Today
Every answer cites a real file:line — never fabricated.
Next
AST / LSP-backed grounding for cross-file correctness across millions of lines.
Umbra inside ChatGPT
Not trapped inside a dashboard.
Ask about your repository, investigate an incident, understand a change — without leaving the conversation. Umbra ships as a GPT Action, grounded in real OSV and git data, never invented. The read-only actions are public; no sign-in required.
Scan github.com/expressjs/express for security risks.
Umbra Score 78/100 · Needs attention
→ fix: upgrade to 4.19.2 (PR-ready diff · branch only)
Grounded in OSV.dev advisories. Nothing was merged.
Why did /checkout start returning 500s?
Traced to one commit in real git history — not guessed:
3 days ago · @dev · touches cart/totals.js:42
Read-only actions
Umbra Score + live CVEs for any public repo.
An error → the root-cause commit from real git history.
A question → an answer with real file:line references.
The operator
Built because software teams shouldn’t wake up to yesterday’s problems.
Your next night shift