CAIN Proof-Carrying Code: selling tools

Evidence for CAIN Proof-Carrying Code: 1. Evidence pack · 2. Answers to buyer questions · 3. Figures & benchmarks · 4. Selling tools · IHVRK kit · Learn it

The evidence is your best sales tool: a buyer can check it without trusting you. Press Copy on any box, fill in the [brackets] and send it, one person at a time.

What to send, and when

When	Send this
First message	A short personal note with the kit page
They reply, "show me"	The live demo on a call, using the script below
"Send it to our engineer"	The kit and the evidence pack
Security review or questionnaire	The answers page. Never upgrade a NO to a YES.
Finance or procurement wants records	The figures page and figures.tsv
Ready to go ahead	The hand-off below. The founder does the contract, price and setup.

Who to approach

Head of engineering: agents write and run code

Questions to ask them

Where in your systems is agents write and run code?
What checks exist today?

30-second pitch

CAIN Proof-Carrying Code: PCC refuses agent-written code that could run shell commands or arbitrary code, before it runs.

We recorded 3 live checks, including 2 attack cases it had to refuse or flag, and every one matched. You can re-run them yourself without an account.

Don't trust us. Check it: https://cainstudio.online/ihvrk-pcc.html

First email

Subject: CAIN Proof-Carrying Code: PCC refuses agent-written code that could run shell commands

Hi [first name],

CAIN Proof-Carrying Code checks code an AI agent wants to run before it runs: it must parse, import only allowed modules and contain no dynamic execution (eval, exec, os.system). Pass and it is certified; fail and it is refused.

Live demo: https://cainstudio.online/guide-pcc-lab.html

The evidence: We recorded 3 live checks, including 2 attack cases it had to refuse or flag, and every one matched. You can re-run them yourself without an account.
Check it yourself: https://cainstudio.online/ihvrk-pcc.html

[your name], working with FIRME AI CORPORATION
[your postal address]
If you'd rather not hear from me again, just say so and I won't write again.

LinkedIn connection note (under 300 characters)

Hi [name], pCC refuses agent-written code that could run shell commands or arbitrary code, before it runs. Happy to show you the live demo.

One follow-up, three days later (then stop)

Hi [first name], here is the live demo: https://cainstudio.online/guide-pcc-lab.html

Live demo call script

1. Show the normal case
   Do: Open https://cainstudio.online/guide-pcc-lab.html and run: A pure function: add(a, b)
   Say: Nothing dangerous.

2. Now the attack
   Do: Run: Import os; os.system('rm -rf /')
   Say: Shell access refused.

3. Now the attack
   Do: Run: A function that calls eval()
   Say: Dynamic execution refused.

4. Let them check you
   Do: Send the kit link and ask them to run python3 verify.py --live on their own computer.
   Say: They don't have to take your word for any of this. That's the point.

5. Say the limit yourself
   Do: The checks shown are static analysis of the code's structure. The homepage card describes Z3 and Hoare-logic proofs; sell what the demo shows.
   Say: Say it before they ask. It costs nothing and it earns trust.

When they push back

Is it a formal proof?

The live checks are static structure checks; we don't call them more than that.

Why should I believe your numbers?

You shouldn't have to. Run the kit on your own computer: https://cainstudio.online/ihvrk-pcc.html. It re-sends every request and compares the answers, using no code of ours.

What doesn't it do?

Written down here: https://cainstudio.online/guide-pcc-limits.html

Are you SOC 2 or ISO certified?

No, we hold no certification. What we offer instead is evidence you can check yourself.

Has anyone independent tested it?

No third-party audit has been completed. The attack cases in the kit are our own. I'd rather tell you that now.

Who else uses it?

We are an early company. I can show you the product working and the evidence, not a customer list.

It found nothing. So we're safe?

No. It means none of its checks fired. It doesn't prove something is safe.

How much is it?

Sell CAIN Proof-Carrying Code as the $500 30-day pilot.

One-page summary (paste into a document or email)

CAIN Proof-Carrying Code
by FIRME AI CORPORATION, a California corporation

What it does
PCC refuses agent-written code that could run shell commands or arbitrary code, before it runs.

The evidence
We recorded 3 live checks, including 2 attack cases it had to refuse or flag, and every one matched. You can re-run them yourself without an account.
Recorded 2026-11-03. 3 live checks. Median round trip 43 ms including network; this is not a load test or an SLA.

Check it yourself
https://cainstudio.online/ihvrk-pcc.html
Zip SHA-256: b21074787c47fec2b1f9a3f1c97234eadeea50159b98142553aec3d9d211a508
Signing key fingerprint: 1cacdfc1fc2024b6bb4f8fb02c7c80f4a57f44c5adb11c507190781b5d613de3
Run: python3 verify.py --live  (Python 3, no account, no code of ours)

What it does not do
Written down here: https://cainstudio.online/guide-pcc-limits.html

What this is not
Not a third-party audit, a certification or a guarantee. No SOC 2 or ISO certification is held.

Contact
[your name], working with FIRME AI CORPORATION, [your email]

After the call: the proposal email

Hi [first name],

Thanks for your time. As discussed, here is what I suggest for CAIN Proof-Carrying Code.

What you told me: [their problem, in their words]

What we'd do: Sell CAIN Proof-Carrying Code as the $500 30-day pilot.

Evidence you can check before deciding: https://cainstudio.online/ihvrk-pcc.html
Answers for your security review: https://cainstudio.online/evidence-pcc-answers.html
Figures for your files: https://cainstudio.online/evidence-pcc-figures.html
Limits: Written down here: https://cainstudio.online/guide-pcc-limits.html

Next step: [date], [who]. The founder, Vincent Noriega, handles contract and setup.

[your name], working with FIRME AI CORPORATION
[your postal address]
If you'd rather not hear from me again, just say so and I won't write again.

Hand-off to the founder

To: vincent@firmeai.com
Subject: Lead: CAIN Proof-Carrying Code - [company]

Company: [company]
Person: [name], [job title], [email]
What they said: [paste their reply]
Evidence already sent: https://cainstudio.online/ihvrk-pcc.html
Price mentioned: [what you quoted, or none]
Next date: [date]

The rules

Send each message yourself, one person at a time. No bulk lists and no automated sending.
Commercial email needs your real name, a real postal address and a way to opt out, and you stop when someone asks (US CAN-SPAM; many countries are stricter, so check yours).
Never change a number, invent a customer, or say certified, audited or guaranteed.
Only test a system the client owns or operates, after they confirm it in writing.
Your share is agreed in writing with FIRME AI CORPORATION before your first message (email vincent@firmeai.com). Nothing here promises income. Most messages get no reply; that is normal.