One control plane, three domains

Policy

• Policy Manager: build a policy by selecting items and conditions. No syntax, no configuration file.
• Policies are written in CEL, a standard expression language, so teams that already use CEL have nothing new to learn.
• Policies belong to projects, so a payments service and internal tooling can follow different rules.
• One policy, enforced at every entry point: agent session, commit, pull request and command line.

Agents

• Earnie ships as an MCP server, compatible with coding agents such as Claude Code and Codex.
• Before an agent writes code, it receives the project's actual findings and policies as context.
• When Earnie flags an issue, such as a quantum-vulnerable algorithm, the agent can fix it on the spot and re-check against the gate.

Repositories and CLI

• GitHub and GitLab: an initial scan of the full repository, then a scan on every commit.
• Pull request checks: a policy violation fails the check, with the evidence and the version that resolves it shown in the PR.
• One CLI for scanning, policy checks and SBOM export. It runs pre-commit and in any CI system.
• Standalone directory and ZIP scans for one-off jobs such as M&A due diligence.

Evidence

• SBOM, CBOM and AIBOM for each project and release, in CycloneDX and SPDX. Notice files generated from the same scan.
• Reproducible output: the same input produces the same record every time.
• Every document carries an audit trail. Records for past releases can be pulled on demand.

Dashboard

• One URL, team invites, single sign-on and role-based views.
• Engineering and OSPO leads see posture across every project. Developers see what changed on their own projects.
• Licence findings shown as side-by-side code comparison, cryptography by call, AI models by provenance, with vulnerabilities alongside.

Cryptography

• An inventory of every algorithm, primitive and cryptographic asset in source code.
• Reachability analysis shows whether a vulnerable algorithm is actually called, including inside dependencies.
• Each asset carries its usage, policy status, lifecycle and health information, so a post-quantum migration plan becomes a queue ordered by exposure.

AI models

• Detection of AI SDK and API calls in source code through static analysis.
• Model files in the repository identified by fingerprinting the weights, not by trusting the filename.
• On-demand scanning of a local model file that never lived in the repository.
• Provenance, licence, lineage and mirrors for each identified model, from the new AI Model Dataset.
• AI model detection also runs as a standalone scan.

Deployment

• Existing API, CLI and CI/CD integrations keep working, with Earnie governance on top.
• On-prem deployment, including fully air-gapped environments.

Governance has to run where code changes

Governance tooling was built for a world where an engineer chose a dependency and a manifest declared it. Agents now pull in libraries nobody chose, generate code that may carry someone else's licensed material, and drop model files into repositories. The volume keeps rising, and most of it arrives without anyone triggering a scan.

Earnie identifies what code actually contains, at the moment it changes. A violation becomes an event raised when it enters the codebase, not a finding discovered in next quarter's review. And because every record is reproducible, the answer is ready when a regulator, a customer or a board asks for it.

Writing policies in natural language is next on the list. Each new Release will be published in Field Notes and dated when it goes out.