Skip to content
@cogniumhq

Cognium Labs

Trust infrastructure for software built with AI agents. Agents do the work. Cognium proves what they did
README.md

Cognium Labs

Trust infrastructure for software built with AI agents. Agents do the work. Cognium proves what they did.

cognium.net

Open source

Three projects, each usable on its own.

cognium-dev — SAST for agent-written code

npm npm License: MIT

Static analysis that finds real vulnerabilities through cross-file taint analysis — across JavaScript, TypeScript, Python, Java, Go, C#, Rust and Bash.

npm install -g cognium-dev
cognium-dev scan ./src

Results are auditable: sast-benchmarks publishes scored runs against OWASP Benchmark, CWE-Bench-Java and Juliet — one dataset revision, one scorer, raw artifacts included.

skillsregistry — find MCP servers and agent skills

License: Apache 2.0

Discover MCP servers and agent skills by what they do, with explicit trust and scan-coverage signals. Connect a client to the hosted, read-only catalog — no API key, no signup:

claude mcp add --transport http --scope user skillsregistry https://api.skillsregistry.net/mcp

The repository holds the Apache-2.0 TypeScript SDK and a self-hostable local node. Unscanned means unscanned, not safe — trust signals are context for review, not a guarantee.

specifica — an open spec format for Git

npm License: MIT

A .specifica/ directory convention for writing software specs as markdown in any Git repo. Three files per feature — spec.md (what), design.md (how), tasks.md (work). Tool-agnostic, and deliberately useful without any tool.

npm install @specifica/format

An open standard anyone can adopt; specifica.app is one editor that implements it.

Also here

Repo What it is
sast-benchmarks Auditable SAST scoring vs CodeQL, Semgrep and others
cognium-ai-action GitHub Action for Cognium security scanning
cognium-buildkite-plugin Buildkite plugin for Cognium Dev
conformis Conformance issues and findings

Contributing

Each repository has its own CONTRIBUTING.md. External contributions are welcome and no CLA form is required — open an issue before starting non-trivial work.

Found a vulnerability? Do not open a public issue. Report it privately to security@cognium.net; see the security policy in the affected repository.

Links

Cognium Labs Inc · 2026

Pinned Loading

  1. specifica specifica Public

    Specifica by Cognium: an open specification format for writing software specs in Git repositories. MIT TypeScript packages — @specifica/format and @specifica/store.

    TypeScript 1 1

  2. cognium-dev cognium-dev Public

    Static Application Security Testing platform - CLI and core library

    TypeScript 5 1

Repositories

Showing 10 of 20 repositories
  • cognium-dev Public

    Static Application Security Testing platform - CLI and core library

    cogniumhq/cognium-dev's past year of commit activity
    TypeScript 5 MIT 1 44 3 Updated Oct 28, 2026
  • skillsregistry Public

    SkillsRegistry by Cognium: discover MCP servers and agent skills with explicit trust and scan-coverage signals. Apache-2.0 SDK and self-hosted node; public read-only MCP endpoint.

    cogniumhq/skillsregistry's past year of commit activity
    TypeScript 4 Apache-2.0 0 16 6 Updated Oct 26, 2026
  • a11y-benchmark-results Public

    Reproducible, product-neutral result bundles for cogniumhq/a11y-benchmark

    cogniumhq/a11y-benchmark-results's past year of commit activity
    JavaScript 0 Apache-2.0 0 0 0 Updated Oct 23, 2026
  • sast-benchmarks Public

    OWASP Benchmark, CWE-Bench-Java, Juliet and more: auditable SAST results for cognium-dev vs CodeQL, Semgrep and others — one dataset revision, one scorer, raw artifacts included.

    cogniumhq/sast-benchmarks's past year of commit activity
    JavaScript 0 MIT 0 1 0 Updated Oct 22, 2026
  • specifica Public

    Specifica by Cognium: an open specification format for writing software specs in Git repositories. MIT TypeScript packages — @specifica/format and @specifica/store.

    cogniumhq/specifica's past year of commit activity
    TypeScript 1 MIT 1 0 1 Updated Oct 22, 2026
  • a11y-benchmark Public

    Accessibility fixture corpus: pages with known WCAG 2.2 outcomes, for scanner recall and false-positive measurement. Grounded in WCAG 2.2, W3C ACT Rules and WAI-ARIA APG. Includes a pipeline-integrity tier that snippet corpora cannot express.

    cogniumhq/a11y-benchmark's past year of commit activity
    JavaScript 0 Apache-2.0 0 0 0 Updated Oct 19, 2026
  • cognium-mcp Public

    The Cognium MCP server and its editor plugins

    cogniumhq/cognium-mcp's past year of commit activity
    TypeScript 0 MIT 0 1 6 Updated Oct 19, 2026
  • cognium-meet Public

    Chrome extension + local API for recording browser tab audio (any http/https tab, including Google Meet), transcribing with OpenAI Whisper or diarized transcription, and generating AI meeting notes and Q&A over your saved meetings.

    cogniumhq/cognium-meet's past year of commit activity
    TypeScript 0 0 0 0 Updated Sep 26, 2026
  • cognium-buildkite-plugin Public

    BuildKite Plugin for Cognium Dev

    cogniumhq/cognium-buildkite-plugin's past year of commit activity
    Shell 0 MIT 0 1 0 Updated Sep 23, 2026
  • .github Public

    Cognium organization GitHub workflow templates

    cogniumhq/.github's past year of commit activity
    0 0 0 0 Updated Sep 22, 2026
View all repositories

People

This organization has no public members. You must be a member to see who’s a part of this organization.