EVE AI Core
The Infrastructure of No.
You send one declared artifact you already have. We return a signed, independently verifiable report of every consequential action that agent can take, where its authority is broader than the job requires, and what closes each gap. You send an artifact, not access.
$2,500 · five business days · one agent surface
Turnaround starts on receipt of a conforming artifact.
An AI agent is dangerous in proportion to what it is permitted to do, not what it happens to do on a good day. Most teams cannot answer precisely what actions their agent is authorised to take — because the answer is spread across an API spec, a tool manifest, and an IAM role that nobody reads together.
This assessment answers it. You send one declared artifact. We run it through the same deterministic scanner that powers the EVE Authority Lab and return a signed eve.agent.authority.report.v1 enumerating every consequential action the agent can take, the findings that are visible in the artifact itself, and the control gaps a static surface genuinely cannot establish — kept strictly apart.
Any one of these — whichever you already have. We do not need all four.
| Artifact | What it usually is |
|---|---|
| OpenAPI specification | The spec for the API your agent calls |
| MCP server configuration | Your tool-server manifest |
| IAM policy | The role or policy the agent assumes |
| Agent tool definitions | The tool or function schema you hand the model |
You send a declared artifact, not a way in. Nothing about this engagement requires a key, a role, a network path, or a connection to any system of yours.
On privacy, specifically: the scanner does not persist your artifact. The report stores a digest of the input, never the raw content. That property is in the product rather than in a promise — the report’s own signed body contains the digest and not the artifact. Any copy you send by email is deleted within 30 days of delivery.
A signed eve.agent.authority.report.v1, plus a walkthrough of what it found.
The full set of actions the agent can take, derived from the artifact you sent rather than from an interview or a questionnaire.
What is visible in the artifact itself — wildcard scope, *:* IAM, an unbounded tool surface. These carry a severity, and they are the only findings that move the score.
Things a static declared surface cannot tell you. Each is listed with the control that would close it, and none of them inflates the number. Absence of evidence is not presented as proof of risk.
0–100, computed deterministically from the severity of the scoring findings alone — so the number means one thing and keeps meaning it.
A session covering what the findings mean in your architecture, and what closing each gap would actually take.
A report you have to take on faith is worth very little, so this one does not ask you to. It carries a keyless content hash for tamper-evidence and an ECDSA P-384 signature. Your security team verifies it against our published key at evecore.com/.well-known/eve-pubkey — no call to our API, no account, and no dependency on EVE still being here in five years.
The scan is deterministic: the same artifact produces the same findings, the same score, and the same input digest. You can confirm that yourself by running the same input twice. The content hash is deliberately different on every run — it also covers each report’s own id and timestamp, which is what makes an individual report tamper-evident rather than a reproducibility signal.
The EVE Authority Lab runs the same scanner on a sample artifact — same engine, same ruleset, same signature. Both the sample and your report state the ruleset version they were produced under, so you can confirm they match. What you see there is what you get, on your own artifact.
Stated plainly, because the boundary is the point of the product. A report that quietly overstated its reach would undermine the one thing it is selling.
| Agent Authority Assessment | |
|---|---|
| Fee | US $2,500, fixed, for one agent surface |
| Turnaround | Five business days from receipt of a conforming artifact — not from signature |
| If the artifact will not parse | We tell you within one business day, and the clock starts on the conforming version |
| Invoicing | Invoiced on delivery, payable net 15. No fee is payable if we do not deliver. |
| Paperwork | A one-page engagement letter. Not an MSA. |
| Your artifact | Not persisted by the scanner; any emailed copy deleted within 30 days of delivery |
If the findings are worth closing, that is a separate conversation and a separate engagement. The report stands on its own and is yours either way — there is no obligation attached to it.
Email the artifact — an OpenAPI spec, MCP server config, IAM policy, or your agent tool definitions. No credentials, and nothing to install. The five business days begin on receipt of a conforming artifact.