CAIN-42 · open source since 2026-11-10

Check us yourself. Free, Apache-2.0.

CAIN-42 is a Byzantine trust fabric. These three tools are its free, open-source trust layer: find AI slop, find and prove security bugs on your own machine, and verify our signed proofs without trusting us.

Run all three right now in your browser → No install, no account; your code never leaves the page.

FALSEWORK — find AI slop

Code that looks finished but fakes the hard part: random numbers presented as measurements, checks that return true when they crash, benchmarks that print PASSED no matter what. Deterministic, no model, no network. Python and JavaScript/TypeScript.

pip install https://cainstudio.online/open-source/falsework-0.1.0-py3-none-any.whl
falsework scan .

Source: tar.gz · zip

PROOFLOOP community — find and prove security bugs

Traces whether outside input (a route, an MCP tool argument, model output) reaches a dangerous call in Python, then with --prove runs the attack in a bubblewrap sandbox. CONFIRMED means the payload reached the shell, eval, the SQL text, the file path or the unsafe loader. Includes a GitHub Action (action.yml) that runs on your own runner and reports to code scanning.

pip install https://cainstudio.online/open-source/proofloop-0.1.0-py3-none-any.whl
proofloop scan . --prove          # Linux; --prove needs: apt install bubblewrap

Source: tar.gz · zip

proofloop-verify — check our proofs offline

Small, readable verifiers for PROOFLOOP records: pull-request proofs, evaluation records, Merkle-tree inclusion, and a pure-Python Ed25519 checker with zero dependencies.

pip install https://cainstudio.online/open-source/proofloop_verify-0.1.0-py3-none-any.whl
proofloop-verify-pure record.json

Source: tar.gz · zip

Check the downloads

Every file's SHA-256 is in SHA256SUMS. Each source archive is a git archive of the exact commit recorded on 2026-11-10 in the milestone record (proofloop-verify 05492d2, falsework 1b27278, proofloop 86304a2).

Free vs paid

	Open source (free)	Hosted PROOFLOOP (paid)
AI-slop detection, Python + JS/TS	✓	✓
Python security detection + reachability	✓	✓
Exploit proof: command, code, SQL injection, path traversal, unsafe deserialization	✓	✓
SSRF, template injection, missing authorization, attack variants, 6 more languages		✓
PR checks, signed proofs, CAIN-42 Byzantine notarization		✓
AI fix proved by an independent test		✓

Honest limits

Detection is heuristic: on fresh, untuned Python repositories about half of serious findings were real in our own evaluation; the sandbox proof is what separates a guess from a bug. The sandbox does not install your dependencies, so some real bugs come back NOT_CONFIRMED. No third-party audit yet. GitHub repositories follow; issues and corrections are welcome at sales@cainstudio.online.