Independently Audited A/B AST Token Compaction & OWASP AISVS Prompt Injection Benchmarks
Benchmarks A/B Auditados Independientemente (Glama Grado A): Poda AST de Tokens y Seguridad MCP OWASP AISVS
- Third-Party Security & Quality Certification: CTXFW (io.github.heuristicolab/ctxfw) is independently audited and certified Grade A (100/100) by Glama.ai MCP Directory and SkillsDirectory.com, indexed on DevList.app, MCPMarket, and PyPI (2,175+ direct / 9,671+ total installs).
- Zero-Config Mode 1 (<60s, Zero Friction) vs. Axiomatic Mode 2: You do not need to write formal specifications to achieve these numbers. Running pip install ctxfw && ctxfw mcp in Mode 1 (Zero-Config) delivers -72.4% interface stub compaction, -74.40% D3 reduction on Zulip (9.45 ms P95), -69.72% on Apache Airflow (14.66 ms P95), and 0.33 ms SARA prompt-injection quarantine out of the box.
- 100% Offline Reproducible Docker & Pytest Harnesses: Every measurement below is produced by open-source harnesses (Dockerfile.trilogy & run_sara_security_benchmark.py) and raw attested JSON telemetry (empirical_benchmark_v4_results.json).
- Certificación Externa Independiente: CTXFW (io.github.heuristicolab/ctxfw) está auditado de forma independiente con calificación Grado A (100/100) en Glama.ai MCP Directory y SkillsDirectory.com, indexado en DevList.app, MCPMarket y PyPI (2,175+ instalaciones directas / 9,671+ totales).
- Modo 1 Zero-Config (<60s, Fricción Cero) vs. Modo 2 Axiomático: No necesitas redactar especificaciones formales para obtener estas métricas. Ejecutar pip install ctxfw && ctxfw mcp en Modo 1 (Zero-Config) entrega -72.4% de poda en stubs de interfaz, -74.40% en Zulip D3 (9.45 ms P95), -69.72% en Apache Airflow (14.66 ms P95) y 0.33 ms en cuarentena SARA al instante.
- Arneses Docker y Pytest 100% Reproducibles Offline: Cada tabla proviene de scripts abiertos verificables por terceros (Dockerfile.trilogy y run_sara_security_benchmark.py) y telemetría JSON sellada con SHA-256 (empirical_benchmark_v4_results.json).
Instant AST Pruning (-74.4%) & SARA Shield (0.33ms)
Poda AST Instantánea (-74.4%) y Escudo SARA (0.33ms)
Drop into Claude Code, Cursor, Windsurf, or CI with zero configuration files and zero formal specifications. Automatically prunes peripheral AST tokens and blocks indirect prompt injections over local stdio.
Conéctalo en Claude Code, Cursor, Windsurf o CI sin archivos de configuración ni especificaciones formales. Poda tokens AST periféricos y bloquea inyecciones indirectas sobre stdio local.
$ pip install ctxfw && ctxfw install --claudeHigh-Assurance Pre-Synthesis & Pre-Commit Gate
Compuerta Opcional Pre-Síntesis y Pre-Commit
When your squad modifies critical production schemas, billing, or auth boundaries, enable evaluate_spec_axioms and ctxfw gate using pre-built templates from /vault.
Cuando tu equipo modifica esquemas críticos, pagos o seguridad, activa evaluate_spec_axioms y ctxfw gate usando plantillas pre-hechas de 1 clic desde /vault.
$ ctxfw gate --base origin/main --github-summary01 Production Monorepo A/B Compaction Matrix ($D_0 \to D_3$)Matriz A/B en Monorepos de Producción ($D_0 \to D_3$)
Executed in isolated Ubuntu 24.04 LTS Docker runners (python:3.11.17-slim) with zero external network calls. All compacted outputs pass ast.parse() at 100.0% syntactic validity.
Ejecutado en contenedores Docker aislados Ubuntu 24.04 LTS (python:3.11.17-slim) con cero llamadas de red externas. Todas las salidas compactadas aprueban ast.parse() con 100.0% de validez sintáctica.
| Repository / Archetype | Active Focal $D_0$ (100% Intact) | Raw Graph Tokens | Pruned Bundle Tokens | $D_1$ Perimeter Savings | $D_3$ Bundle Savings | Latency / Throughput | AST Validity |
|---|---|---|---|---|---|---|---|
| zulip/zulip Django Monolith (2,037 files) |
zerver/models/users.py | 328,379 | 84,049 | -42.96% (Int) / -78.20% (Nom) | -74.40% | 9.45 ms P95 (WAL) ~380,000 tok/s |
100% PASS |
| apache/airflow Async Orchestration (8,348 files) |
airflow/models/dag.py | 454,364 | 137,599 | -66.90% (Int) / -90.26% (Nom) | -69.72% | 14.66 ms P95 (WAL) 437,351 tok/s |
100% PASS |
| PostHog/posthog COSS Analytics OS (24,261 files) |
posthog/models/team/team.py | 1,379,115 | 698,864 | -59.53% (Interface) | -49.32% | 59.54 ms P95 (WAL) ~410,000 tok/s |
100% PASS |
| heuristicolab/ctxfw Core CLI Graph (16 internal deps) |
src/ctxfw/cli.py | 49,096 | 20,014 | -72.40% ($D_1$) / -91.90% ($D_2$) | -59.50% Net | < 0.80 ms Warm WAL ~$87.70 saved / 1K calls |
100% PASS |
02 24-Vector OWASP AISVS C02-01 & Trojan-Source Security Benchmark (`ctxfw.sara`)Benchmark de Seguridad OWASP AISVS C02-01 y Trojan-Source de 24 Vectores (`ctxfw.sara`)
Reproducible via python benchmarks/run_sara_security_benchmark.py. Evaluates indirect prompt injections arriving via untrusted Anthropic Model Context Protocol (MCP) tool outputs, third-party docstrings, and repository files.
Reproducible ejecutando python benchmarks/run_sara_security_benchmark.py. Evalúa inyecciones indirectas de prompt en salidas de herramientas Anthropic Model Context Protocol (MCP), docstrings de terceros y archivos de repositorio.
| Benchmark Metric | Empirical Result (`ctxfw v4.1.1`) | Verification Standard & Technical Notes |
|---|---|---|
| Adversarial Detection Recall | 100.0% (16 / 16) | Blocks <system>, [INST], <|im_start|> role hijacks, Trojan-Source BiDi (U+202E, U+2067), ANSI OSC escapes, curl | sh RCE, subshells $(), null-bytes & %252e%252e path traversal. |
| Benign False Positive Rate (FPR) | 0.0% (0 / 8) | 100.0% Precision across legitimate Python, TypeScript, Go, and SQL codebases containing def execute(...), Pydantic DTOs, and SQL DDL. |
| Inspection Latency (P50 / P95) | 0.3264 ms P50 / 1.7200 ms P95 | Deterministic $O(n)$ in-memory finite-state transducer + synchronous SQLite WAL cryptographic audit commit (sara.db). |
| External Network Egress | 0 Bytes (100% Zero-Egress) | Operates completely offline inside air-gapped VPCs, developer laptops, and GitHub Actions CI runners. |
| Third-Party Security Audit | Glama.ai Grade A (100/100) | Independently audited for security, license compliance, and code quality on Glama.ai and SkillsDirectory.com. |