Beacon beta · open to sign-ups
See your own evidence the way a buyer, auditor, or insurer would.
Inside data, not guesses. The Beacon Collector reads the security tools you already run, seals what it finds into a tamper-evident evidence package, and scores it against open, published rubrics. It runs on your machines. Nothing is sent to VCRI unless you choose to send it.
What you get in the beta
Agent constellation inventory
Every model, harness, MCP server, plugin, prompt, and memory store your AI agents depend on, with versions and hashes, as a CycloneDX AIBOM. Run it again later and see what drifted.
Evidence from your own tools
Scanner results, SBOMs, identity-provider exports, training records, OpenSSF Scorecard results, and OSCAL documents, collected and labeled by how strong the evidence is.
A sealed evidence package
Every item is hashed, and the whole package carries one fingerprint and a signature. Change a single byte and verification fails. You can prove later exactly what you had on a given day.
Your score, on one page
A results page you open in a browser: your score by area, the evidence behind each number, and the gaps, with the package fingerprint printed on it. Beta scores use a draft method and are labeled that way.
Policy and document evidence
Upload policies and reports as evidence. They count, at a lower weight than evidence your systems produce, because a document says what should happen, not what did.
Independent timestamps and escrow
Public timestamping of your package fingerprint, and optional escrow with VCRI so the buyers you choose can check your posture without asking you for a questionnaire.
How it works
- Install the collector on a machine that can reach your tools. Python or a signed container.
- Point it at what you already have: a scan, an export, an SBOM, your agents' config.
- Seal. The collector writes the evidence package and its fingerprint.
- Open your results page and see the score, the evidence, and the gaps.
- Tell us what was confusing, missing, or wrong. That is the beta.
Our promise for the beta: the code is open, it runs where you run it, and your evidence stays with you. VCRI is a nonprofit and a neutral party. We grade evidence, we do not sell your data, and no vendor can buy a better result.