Trust infrastructure for software built with AI agents. Agents do the work. Cognium proves what they did.
Three projects, each usable on its own.
cognium-dev — SAST for agent-written code
Static analysis that finds real vulnerabilities through cross-file taint analysis — across JavaScript, TypeScript, Python, Java, Go, C#, Rust and Bash.
npm install -g cognium-dev
cognium-dev scan ./srcResults are auditable: sast-benchmarks publishes scored runs against OWASP Benchmark, CWE-Bench-Java and Juliet — one dataset revision, one scorer, raw artifacts included.
skillsregistry — find MCP servers and agent skills
Discover MCP servers and agent skills by what they do, with explicit trust and scan-coverage signals. Connect a client to the hosted, read-only catalog — no API key, no signup:
claude mcp add --transport http --scope user skillsregistry https://api.skillsregistry.net/mcpThe repository holds the Apache-2.0 TypeScript SDK and a self-hostable local node. Unscanned means unscanned, not safe — trust signals are context for review, not a guarantee.
specifica — an open spec format for Git
A .specifica/ directory convention for writing software specs as markdown in
any Git repo. Three files per feature — spec.md (what), design.md (how),
tasks.md (work). Tool-agnostic, and deliberately useful without any tool.
npm install @specifica/formatAn open standard anyone can adopt; specifica.app is one editor that implements it.
| Repo | What it is |
|---|---|
| sast-benchmarks | Auditable SAST scoring vs CodeQL, Semgrep and others |
| cognium-ai-action | GitHub Action for Cognium security scanning |
| cognium-buildkite-plugin | Buildkite plugin for Cognium Dev |
| conformis | Conformance issues and findings |
Each repository has its own CONTRIBUTING.md. External contributions are
welcome and no CLA form is required — open an issue before starting
non-trivial work.
Found a vulnerability? Do not open a public issue. Report it privately to security@cognium.net; see the security policy in the affected repository.
- cognium.net — company
- cognium.dev — Cognium SAST
- skillsregistry.net — catalog and product docs
- specifica.org — the open spec format
- hello@cognium.net
Cognium Labs Inc · 2026