Static scans that comment on the pull request
Install the GitHub App and every pull request is scanned for authorization gaps, tenant isolation, injection, JWT mistakes, and AI-specific patterns. Findings land as inline review comments and a Check Run, and one click turns them into an executive summary.
- GitHub App PR comments and Check Runs — no tokens to paste
- Findings with file:line and a remediation sentence
- Executive, technical, and compliance reports from the same findings
A fail-closed gateway, firewall, and DLP on live traffic
Point your app at the OpenAI-compatible gateway, or wrap calls with the SDK. Prompts, RAG chunks, tool results, and outputs are checked against your policies and allowed, warned, blocked, or redacted. If a check errors, the request is blocked — never silently passed through.
- Prompt-injection and jailbreak screening on input and output
- DLP redaction for PII and secrets in model output
- Human-in-the-loop approval for high-agency tools (email, shell, file share)
- OpenAI-compatible gateway — use alongside your existing provider routing
curl -s https://app.belfrylabs.ai/api/v1/gateway/v1/chat/completions \
-H "Authorization: Bearer bak_…" -H "X-Tenant-ID: $TENANT" \
-d '{"model":"gpt-4o-mini","messages":[{"role":"user","content":"…"}],
"metadata":{"session_id":"s1","rag_chunks":["…"]}}'Red team campaigns and a human-confirmed live pen-test
Seed adversarial campaigns from the product and replay them as policies change. When you need proof for a buyer or an audit, the Enterprise Assessor runs live probes against your deployment — only after a human confirms the rules of engagement.
- Attack corpus mapped to MITRE ATLAS techniques
- Purple-team loop: runtime events seed the next campaign
- Live Assessor with CVSS-normalized findings and a signed RoE
Evaluations and model comparison on your own datasets
Run quality, safety, latency, and cost evaluations across OpenAI, Anthropic, Google, and more. Golden datasets stay inside your tenant, and every run is reproducible from a saved config.
- Side-by-side model comparisons with the same prompts
- Golden datasets for regression checks before a model swap
- One engine for scans, benchmarks, and red-team runs
Model inventory with expiry and degradation tracking
Every model, dataset, tool, and knowledge base in one registry. Belfry tracks lifecycle state, flags expiring artifacts, and watches golden-set scores for degradation so a silent provider-side model change shows up before your users notice.
- Asset registry across models, datasets, tools, and MCP servers
- Expiry and review reminders with days-remaining alerts
- Degradation alerts when golden-set scores drift
Compliance scorecards, SBOM/AIBOM, and approvals
Map current findings onto EU AI Act, NIST AI RMF, and ISO/IEC 42001 as a point-in-time scorecard of your system — not a certification of Belfry Labs. Export evidence packs, generate an SBOM/AIBOM with SLSA provenance, and route changes through approval workflows.
- Point-in-time scorecards with evidence export
- SBOM/AIBOM in CycloneDX, SPDX, and SARIF
- Approvals and audit trail for every state change
An MCP mesh you register, health-check, and govern
Register tenant MCP servers and A2A peers, run health checks, and make guarded test calls through the same runtime policies as chat traffic. Belfry itself is also an MCP server, so Cursor and Claude can list projects, run scans, and build executive reports.
- Registry with lifecycle state, trust score, and health
- Lookalike-server and descriptor-poisoning detection
- Belfry-as-MCP: scans, findings, and reports as tools
{
"mcpServers": {
"belfry": {
"command": "python",
"args": ["-m", "belfry_labs.mcp_server"],
"env": { "BELFRY_API_KEY": "bak_…" }
}
}
}Cost tracking and cost-aware routing
See estimated spend per project, per model, and per route. When a cheaper eligible model meets your quality bar, the gateway can route to it — and optional monthly budget caps stop runaway spend at inference time.
- Spend trends and forecasts per project
- Cost-aware routing with a quality floor
- Optional monthly budget caps enforced at inference
Start with the free taste
Ten GitHub PR scans and one architecture review, no card. Paid plans are per project — talk to us to upgrade.
Resources: Docs · Quickstart · API · SDK