AGENTIC AI 75 · CAIN-A75-023

Vulnerability-to-Patch Proof

Autonomous vulnerability investigation and repair

Last reviewed 2026-11-11

DELIVERABLE Fix + Prove Moat lineage: 2026 #23 · operator stream 5

An engine in this repository produces a bounded artifact from a supplied sample today.

What you buy

A defensible answer for this class of system: Keep detection deterministic, make the fix a proposal, and prove it with a test the fixer did not author. The run is bounded and the limits are printed with the result.

A bounded engine run on the buyer's sample: findings, a written report, and a SHA-256 artifact manifest. The manifest is unsigned: it is not a signature and not an attestation.

Price and terms (proposal)

List figure	$2,500–$5,000 per engagement
Indicative band	$500–$2,500 one-time (fix)
Lead time	5 business days after a signed SOW and sample intake
Buyer	Security engineering and AppSec teams

The list figure comes from the individual offer; the band is the line default. Neither is an invoice. Scope is fixed in a one-page SOW before work starts.

Scope

One repository or one bounded patch set; up to five findings; written verdict per finding.

Inputs we need

A source tree or sample patch
The project's test command
The property or failure to prove

What you receive

findings.json
report.md
manifest.json

Explicit exclusions

No vendor integration or partnership is included or implied.
No legal, tax, clinical, insurance or safety certification advice.
No third-party audit, SOC 2 report, ISO certification or patent filing.
No production write access; work runs on samples the buyer supplies.
No 24/7 response unless a separate retainer is signed.

Engine and evidence

This SKU is engine-backed: mcp_tool_scan in mcp-security-scanner/engine.py. The operator runs it on your sample with python3 -m cain_agentic_products.cli deliver CAIN-A75-023 --out DIR.

The 2026 development and the CAIN-42 mapping · Check the mechanism · Fire a live governed decision · Public evidence

Next step

Request a scoped quote or a paid pilot: book a 20-minute scoping call. Bring one sample and the decision you need to defend. If the sample is not a fit, we will say so before you pay.

What this offer is not. No customer, partnership, endorsement, certification, patent or third-party audit is claimed. Prices are proposals, not validated rates. DELIVERABLE means a bounded engine run on a sample, not an assessment of a production system. Built by a three-person team.

← CAIN-A75-022 Agent Wallet Mandate ReviewCAIN-A75-024 Coding-Agent Action Gate →