TRUSTIVAN Technical Documentation
The Engineering Reference for
Modern AppSec & Machine Authority
Deterministic container scanning, an append-only finding lifecycle, a pure-function policy engine, and the control plane for Non-Human Identities & AI Agents.
Choose Your Implementation Path
Zero-configuration container scans, reproducible CI/CD policy gates, and runtime access intelligence.
End-to-End Onboarding Guide
Step-by-step implementation for container scans, CI release gates, NHI machine graph, and MCP runtime guardrails.
Container Scanning in 30 Seconds
Pull and analyze an image from public or private registries. Zero docker socket access, zero root privileges.
Gating CI/CD with Pure Verdicts
Evaluate declarative rules as a pure function. Produce immutable PASS, WARN, or BLOCK verdicts in your pipeline.
Machine Identity Discovery & Graph
Map service accounts, tokens, and keys across AWS, GitHub, K8s, and Vault into an explainable graph.
Autonomous Agent Tool Guardrails
13 deny-by-default rules outside the LLM. Authorize tool calls, enforce blast-radius limits, and quarantine.
Complete System Documentation
Designed for security engineers, DevSecOps practitioners, and enterprise architects who require verified evidence.
1. Scanner & Finding Lifecycle
Remote Registry Pull Architecture
CoreHow images are fetched and parsed without host daemon access
The 5 Finding States
SpecOpen, Triaged, Suppressed, Resolved, Reopened transition contract
Hash-Chained Audit Trail
EvidenceCryptographic proof of evidence that auditors can verify offline
SBOM Ingestion & Export
StandardsCycloneDX 1.5 and SPDX 2.3 standard interchange support
2. Policy Engine & Verdicts
Declarative Rule Schema
SchemaStrict YAML/JSON rule structure evaluated without runtime side-effects
Deterministic Verdict Triad
VerdictALLOW, WARN, ENFORCE output definitions and reproducible logic
KEV & Exploit Enrichment
IntelReal-time CISA Known Exploited Vulnerability priority escalation
Suppression Rules & Expiry
GovernanceAudited acceptance with mandatory owners and maximum 2-year ceilings
3. Machine API & Integrations
API Authentication & Scoped Keys
SecurityExpiring bearer tokens scoped strictly to read or scan operations
Signed Webhook Specification
EventsHMAC-SHA256 signatures, replay protection headers, and retry backoff
CI/CD Pipeline Integration
RecipesRecipes for GitHub Actions, GitLab CI, Jenkins, and shell scripts
SCIM & Directory Sync
EnterpriseAutomated deprovisioning leaving an immutable evidence trail
4. Non-Human Identity & Agent Security
Identity Graph Schema
GraphNodes, relationships, credentials, and effective permission resolution
13 Deny-by-Default Rules
AgenticDeterministic runtime interception outside the LLM context window
MCP Server Security Protocol
MCPLeast-privilege tool isolation for Model Context Protocol agents
Ephemeral Access Grants
AccessTime-bounded credentials with cryptographic provenance records
Machine API & Workflows
Built for Automated CI/CD Pipelines
Every operation is accessible through an idempotent HTTP API. Request scans, evaluate policies, branch on signed verdicts, and ingest webhooks without installing intrusive daemons.
# 1. Trigger container scan with scoped credential
curl -s -X POST https://api.trustivan.com/v1/scans \
-H "Authorization: Bearer $TRUSTIVAN_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"image": "registry.corp.internal/production/auth-service:v2.4.1",
"idempotency_key": "ci-build-84920"
}' | jq .
# 2. Check deterministic policy verdict
VERDICT=$(curl -s https://api.trustivan.com/v1/scans/scan_01H.../verdict \
-H "Authorization: Bearer $TRUSTIVAN_API_KEY" | jq -r .verdict)
# 3. Branch pipeline cleanly
if [ "$VERDICT" == "ENFORCE" ]; then
echo "Pipeline blocked: High-risk vulnerabilities violate policy rule: no-critical-kev"
exit 1
else
echo "Scan approved with verdict: $VERDICT"
fiNeed the raw OpenAPI schema or full SDK reference?
Visit our dedicated documentation instance for interactive API consoles and parameter explorers.