In the docs Guard & evidence
Violin / Documentation
Guard & evidence
Understand what runs, what gets blocked, and what a signed receipt proves.
Try an execution scenario
See how scope, task state, and command checks affect a request. This is an illustrative demo, not a live agent.
What the evidence can tell you
Receipts authenticate execution evidence. Severity, impact, and report inclusion still require your judgment.
A Single Run is a Noisy Sample
Agentic runs vary run to run. Violin reports a distribution — mean pass@1, pass@k, pass^k — and prefers the mean to the best run. A repo test pass is not a live benchmark score.
The Guard is Not Containment
The guard constrains what the agent is allowed to run against an approved scope. It does not isolate your physical network for you; run in an isolated environment.
No Model Choices Baked In
Violin adds no credentials and selects no model provider; it uses your Hermes configuration. Use a capable frontier model — weaker models produce weaker hypotheses, not safer ones.
Receipts Are Not Judgment
Receipts authenticate what was sent and received. Severity, impact, exploitability, and whether a finding belongs in the report remain human calls.
Compare execution architectures
Architectural patterns, not a product ranking. Implementations vary.
| Architecture Dimension | Autonomous Black-Box Agent | General Agent + Shell Access | Violin Profile |
|---|---|---|---|
| Scope Enforcement | Implementation-dependent scope controls | Whatever the prompt instructed | Every command validated against an approved scope file, fail-closed |
| Evidence Model | Implementation-dependent report and evidence output | Markdown prose generated by the model | Signed execution receipts; findings must cite receipts that prove them |
| Coverage Accounting | Whatever built-in checks were executed | Requires explicit coverage tracking | Coverage matrix with disposition gates closed out at reporting |
| Specialist Methodology | Product-specific checks and integrations | Generic reasoning per prompt | 35 routed playbooks across 7 skills, chosen per active PTT task |
| State Across Sessions | Server-side run record | Prompt context window | Persistent engagement state on disk: PTT, hypotheses, checkpoints |
| Tool Execution | Proprietary internal tools | Anything the shell can reach | Guard-gated use of non-interactive tools in your Kali/Parrot image |
| Deployment Model | Hosted or local, depending on implementation | Local machine | Local environment, your model config, inherits your configured model backend |
Where Violin fits
Scope Checked Per Command
Every target command is AST-resolved against the approved scope before execution starts. Out-of-scope hosts and excluded URL paths are denied fail-closed, not logged-and-run.
Your Tools, Your Image
No tool-specific execution adapters and no fragile binary
allowlists: installed non-interactive tooling
(nmap, nuclei, ffuf,
sqlmap, curl) drives through one
boundary.
Coverage You Can Defend
A coverage matrix generated from scope obligations plus methodology disposition gates means every in-scope route and required testing category ends with a disposition — not with silence.
Evidence for the Report
Findings carry severity, summary, and the signed receipts that authenticate decisive request and response bytes — the verifiable artifact needed during client readouts.
Survives Context Compression
PTT tasks, hypotheses, checkpoints, command history, and evidence live in structured state on disk. Long assessments do not reset when prompt context gets summarized.
Human-in-the-Loop by Design
Bounded command bursts are reviewed and settled after execution, pending batches can be rebound, and phase transitions require explicit task activation.
✓ Use it for
- Scoped web, API, identity, business-logic, and LLM-security testing
- Consultants who need per-finding evidence and a defensible coverage story
- Teams that need to inspect how an agent reached each finding
- Authorized lab, CTF-style, and internal assessment work
✗ Do not use it for
- Anything without written authorization and an approved scope
- Unattended mass scanning of hosts you do not own
- Replacing human judgment on severity, impact, or business context
- Network containment — that is your environment's job, not the profile's