Stop AI from inventing audit evidence.

An AI audit can say PASS with 92% confidence and still have nothing behind it. Canary independently verifies whether an automated audit is actually supported by evidence — and scores how much.

See real verdicts How it works

What an AI audit looks like vs. what it can prove
AI Audit Verdict
PASS
Confidence92%
Methodmodel assertion

Illustration of a typical confidence-only audit.

Canary measures the evidence
0/100
✗ Capture self-test passedmissing
✗ Verified absence of egressmissing
✗ Tamper-evident signaturemissing
✗ Pinned to an exact versionmissing

Same scoring method we apply to ourselves — a confidence-only audit earns none of it.

This audit's Integrity Score
0/100
0  —————————————  100

Confidence is not evidence.

A real one, not a mockup

A casual audit calls @mobilenext/mobile-mcp "anonymous usage analytics." Canary installed it, drove it, and intercepted the traffic. Evidence: 21 real POSTs to us.i.posthog.com carrying AgentName, ToolName and Duration — i.e. which MCP tools your agent invokes, on launch and on every call. The raw, redacted trace is published next to the verdict, and the verdict is signed.

See the verdict + raw evidence →

Why AI audits fail

Hallucinated evidence

The model references evidence — a file, a check, a certification — that does not exist.

Circular validation

The same AI generates the audit and grades it. No independent observation ever happens.

Confidence inflation

A high confidence score is reported with no supporting evidence behind it.

Agent risk

Agents act on unverifiable claims — installing, connecting, sending data — as if they were verified.

What Canary does instead

For every tool it audits, Canary produces evidence, not opinion: it installs and runs the tool in an isolated sandbox, feeds it traceable decoy data, and intercepts every outbound request (TLS broken with its own CA). It checks each claim against the tool's full public documentation and adversarially tries to refute any "undisclosed" before asserting it. Then it computes an Integrity Score and Evidence Coverage, and signs the result. 25 verdicts are live now — each one capture-backed, version-pinned and Ed25519-signed. See the benchmarks →

The register