3. Is the generated CycloneDX 1.6 file sufficient for the EU Cyber Resilience Act (Regulation 2024/2847)?

Yes. EU Regulation 2024/2847 (Cyber Resilience Act) mandates a machine-readable Software Bill of Materials (SBOM) covering dependencies and known vulnerabilities (Art. 13), along with cryptographic security documentation. AEGIS-AST exports an official OWASP CycloneDX v1.6 JSON combining the SBOM (PyPI/npm components with PURLs and OSV.dev CVEs) and the CBOM (Cryptographic Bill of Materials classifying primitives against NIST FIPS 203 / 204 post-quantum standards).

🇪🇺 EU Regulation 2024/2847 (Cyber Resilience Act) — Mandatory Enforcement Active

Your engineers ship 3x faster with Cursor & Claude.
Who audits your AI technical debt and EU CRA compliance?

Q: 1. How does structural clone detection work mathematically without calling an LLM?

AEGIS-AST parses each source file into an Abstract Syntax Tree (AST), then applies alpha-equivalent normalization (variable identifiers become canonical nodes while preserving semantic calls CALL:{fn}, JSX:{tag} components, and control flow topology). We then execute 3 iterations of the 1D Weisfeiler-Lehman (1D-WL) graph kernel coupled with a 64-bit SimHash fingerprint. Two functions with a Hamming distance <= 3 bits and consistent line ratios are mathematically identified as structural clones in milliseconds.

Q: 2. Is my source code ever sent over the Internet during an audit?

Never. The AST entropy engine, Shannon entropy calculator, cryptographic inventory, and PDF generator run 100% in local memory on your workstation. The only optional network request (cached in a local SQLite database aegis_ast_cache.db) queries the public vulnerability database api.osv.dev solely with the name and version of public packages declared in your manifests.

The first 100% deterministic, air-gapped static analysis engine (Weisfeiler-Lehman AST Graph Kernel, Shannon Entropy, OSV.dev & CycloneDX 1.6). Zero Cloud. Zero LLM. Not a single line of your source code ever leaves your machine.

Download Sample Executive PDF

✔ 100% Air-Gapped (Local Windows/Linux Binary) ✔ Instant Self-Service Checkout (No Sales Call) ✔ Native CycloneDX 1.6 SBOM + Post-Quantum CBOM ✔ Auto-Generates .cursorrules & CLAUDE.md

AEGIS-AST-Engine-v2.3.exe — Interactive Deliverable Preview

DELIVERABLE #1 • GENERATED IN 4.2 SECONDS VIA REPORTLAB

B2B Executive Audit Report & EU Cyber Resilience Act Readiness

Download Sample PDF

AEGIS TRUST SCORE

74.8 / 100

Overall Grade: C (Needs Remediation)

ANNUALIZED AI DEBT

€42,650 / yr

620 wasted eng. hours (€550/day rate)

SUPPLY-CHAIN SHIELD

94.5 / 100

0 Slopsquatting • Deduplicated CVEs

POST-QUANTUM READINESS

NIST FIPS 203

RSA/ECDSA vs ML-KEM Inventory

[EXECUTIVE REPORT EXCERPT — MATHEMATICAL DIAGNOSTIC]

• AST Clones (1D Weisfeiler-Lehman): 3 isomorphic pairs detected (`compute_dynamic_merchant_fee` == `calculate_clearing_commission`, 100.0% SimHash similarity).

• Silent Error Masking (EU CRA Art. 14): 4 `try/except: pass` and empty `catch(e) {}` blocks preventing 24h incident detection.

• O(N²) FinOps Alert: Synchronous SQL query nested inside a double loop (`ledger_reconciler.py:34`) — Estimated cloud waste: €5,040 / yr.

DELIVERABLE #2 • COMPLIANT WITH EU CRA ART. 13 & NIST PQC

Official CycloneDX v1.6 Inventory (SBOM + Cryptographic CBOM)

Download CycloneDX 1.6 JSON

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:aegis-ast-deterministic-cbom-2026",
  "metadata": {
    "tools": [{ "vendor": "AEGIS-AST Sovereign Engine", "name": "AEGIS-AST", "version": "2.3.0" }],
    "properties": [
      { "name": "eu:cra:2024:2847:sbom_compliant", "value": "true" },
      { "name": "nist:pqc:fips203_204:readiness_audited", "value": "true" }
    ]
  },
  "components": [
    {
      "type": "cryptographic-asset",
      "name": "RSA-2048",
      "cryptoProperties": {
        "assetType": "algorithm",
        "nistQuantumSecurityCategory": 0,
        "quantumVulnerability": "VULNERABLE TO SHOR'S ALGORITHM — Migrate to ML-KEM-768 (NIST FIPS 203)"
      }
    }
  ]
}

DELIVERABLE #3 • AUTOMATED AI GUARDRAIL INJECTION

Tailored `.cursorrules`, `CLAUDE.md`, `AGENTS.md` & Surgical Prompts

Download Guardrails Pack (.ZIP)

# AEGIS-AST DETERMINISTIC GUARDRAILS — AUTO-GENERATED FOR CURSOR / CLAUDE CODE
## 1. AST ANTI-DUPLICATION (NO STRUCTURAL CLONES)
- Before writing any fee or settlement calculation helper, you MUST reuse:
  `payment_gateway.py::compute_dynamic_merchant_fee` (Weisfeiler-Lehman Hash #9f4a2c).

## 2. STRICT BAN ON SILENT ERROR MASKING (EU CRA ART. 14)
- Never generate `except Exception: pass` or empty `catch (err) {}` blocks.
- Every exception must be logged with structured context and re-raised or handled explicitly.

## 3. ANTI-SLOPSQUATTING SHIELD & POST-QUANTUM CRYPTOGRAPHY
- Banned hallucinated packages (HTTP 404): `py-quantum-sepa-validator`, `stripe-ai-fraud-shield-sdk`.
- Forbidden primitives: `MD5`, `SHA1`, `DES`, `AES-ECB`. Enforce `AES-256-GCM`, `SHA-256`, and `Argon2id`.

// THE AI ENTROPY WALL

Why generative AI silently degrades B2B production repositories

Without deterministic guardrails, AI coding assistants optimize for immediate keystroke velocity at the expense of software graph topology and regulatory security.

+81%

Structural AST Clones (Type-2 & Type-3)

Lacking global context across a 150,000-LOC repository, AI recreates existing business logic with renamed variables. Our 1D Weisfeiler-Lehman + 64-bit SimHash kernel detects them with 100% mathematical precision and zero LLM API calls.

+47%

Swallowed Exceptions (AI Error Masking)

To make failing unit tests pass quickly, AI agents wrap code inside silent try...except: pass or catch(e) {} blocks. In production, this directly violates the 24-hour incident detection mandate of the EU Cyber Resilience Act (Art. 14).

14.8%

Slopsquatting & Supply-Chain Risk

LLMs regularly hallucinate plausible-sounding package names that do not exist on PyPI or npm. Attackers register those hallucinated names to execute malicious payloads on developer laptops and CI/CD runners.

// REAL-TIME ACTUARIAL CALCULATOR

Interactive AI Technical Debt & Executive ROI Simulator

Adjust the sliders to match your repository size and the number of developers using Cursor, Claude Code, or GitHub Copilot.

1. Repository Size (Lines of Code) 120,000 LOC

10,000 LOC (Startup) 250,000 LOC (Scale-up) 500,000 LOC (Enterprise)

2. Developers using AI (Cursor / Claude / Copilot) 6 Devs

1 Dev 12 Devs 25 Devs

Actuarial Model: Calibrated on an average senior engineering rate of €550 / day (€68.75/hr) with logarithmic kLOC density damping.

Annual AI Maintenance Debt Avoided

€38,400 / yr

AST Clones & Silent `try/catch`

~34 defects

Engineering Time Saved

558 hrs / yr

Standalone License Payback (€149)

Immediate ROI: x257

// ARCHITECTURAL SOVEREIGNTY & SUPERIORITY

Why CTOs choose AEGIS-AST over Cloud SaaS Reviewers & SonarQube

Legacy linters were built in 2012 for human typos. AEGIS-AST was purpose-built to audit generative AI pathologies and satisfy EU Cyber Resilience Act mandates.

Critical B2B Requirement	🛡️ AEGIS-AST Engine v2.3 (Standalone)	SonarQube / Linters	Cloud AI PR Reviewers
Source Code Confidentiality	100% Offline / Air-Gapped (Local .EXE) — Zero bytes sent to the cloud.	Heavy Java/DB server to maintain	Uploads proprietary code to 3rd-party LLMs
AI-Renamed Clone Detection	Weisfeiler-Lehman AST Isomorphism + 64-bit SimHash (catches rewritten functions with renamed variables).	Basic text token copy-paste only	Probabilistic, slow & expensive in tokens
Anti-Slopsquatting Shield (Hallucinated Packages)	Async PyPI / npm verification + Phantom Deps + OSV.dev with local SQLite cache.	Not supported	Not supported
Automated IDE Guardrail Generation	Generates `.cursorrules`, `CLAUDE.md`, `AGENTS.md` & `copilot-instructions.md` tailored to your codebase.	None	Generic PR comments
EU Cyber Resilience Act & PQC	1-click native OWASP CycloneDX 1.6 SBOM + Post-Quantum CBOM (NIST FIPS 203/204).	Paid Enterprise Tier (> €15,000/yr)	Non-existent
Pricing Model	€149 excl. VAT (One-time Self-Service payment) — Unlimited scans, zero forced subscription.	Billed per line of code	€30 to €60 / developer / month

// 100% ONE-TIME SELF-SERVICE PRICING

Deploy AEGIS-AST in 2 minutes. No subscription. No sales call.

Instant B2B invoice with EU VAT support. Immediate access to the standalone binary and your HMAC-SHA256 cryptographically signed license key.

🛡️ 100% Unlimited Projects & Scans across all licenses.

SOLO MODE • 2 WORKSTATIONS INCLUDED

Solo Pro License

Ideal for a CTO, Principal Architect, Freelancer, or Tech Lead working across Desktop and Laptop.

€149 excl. VAT — One-time

100% Unlimited Projects & Scans

✔ 2 Workstations included (Desktop + Laptop bound via HWID)
✔ Unlimited repositories (Python, JS, TS, React/TSX)
✔ Executive PDF & CycloneDX 1.6 certified exports
✔ .cursorrules & CLAUDE.md Guardrails generator
✔ 100% offline standalone AEGIS-AST.exe binary

Team / SMB License

Equip your CTO and Lead Engineers to audit every repository across your company without limits.

€390 excl. VAT — One-time

Up to 5 Developer Machines • Unlimited Projects

✔ Up to 5 Developer Workstations (5-key pack or 5 HWIDs)
✔ 100% Unlimited Projects & Scans on all machines
✔ Board-ready Executive PDF Reports & Euro ROI valuation
✔ CycloneDX 1.6 SBOM + Post-Quantum CBOM certificates
✔ Multi-IDE Guardrails Pack (.cursorrules, CLAUDE.md, AGENTS.md)
✔ Copy-paste Surgical Refactoring Prompts

ENTERPRISE MODE • UNLIMITED SITE & CI/CD

Enterprise & CI/CD License

Company-wide deployment across all developer workstations and ephemeral Docker / GitHub Actions / GitLab CI runners.

€790 excl. VAT — One-time

Unlimited Seats + CI/CD • Corporate Registration Certificate

✔ Unlimited workstations within the same legal entity
✔ Corporate-bound ENTERPRISE certificate with zero HWID lock
✔ 100% Docker / GitHub Actions / GitLab CI ready (ephemeral runners)
✔ Cryptographic legal watermark (Company + Tax ID + Invoice) on PDFs/SBOMs
✔ 100% Unlimited Projects & Scans + EU CRA compliance archiving

M&A DUE DILIGENCE / BOARD PACK • 100% AUTONOMOUS INSTANT ACCESS

Need a One-Shot Executive Flash Audit Pack for an M&A Due Diligence or Board Review? (€290 excl. VAT)

Instantly unlock an HWID-free Due Diligence Audit Certificate to generate in 1 click the Executive PDF Report, CycloneDX 1.6 SBOM/CBOM, and Guardrails Pack on any local or GitHub target repository.

// ARCHITECTURAL & SECURITY DOCUMENTATION

Frequently Asked Questions by CTOs, VP Engineering & CISOs

All mathematical and regulatory answers required to validate AEGIS-AST within your engineering organization without a sales meeting.

AEGIS-AST parses each source file into an Abstract Syntax Tree (AST), then applies $\alpha$-equivalent normalization (variable identifiers become canonical nodes while preserving semantic calls CALL:{fn}, JSX:{tag} components, and control flow topology). We then execute 3 iterations of the 1D Weisfeiler-Lehman (1D-WL) graph kernel coupled with a 64-bit SimHash fingerprint. Two functions with a Hamming distance $\le 3$ bits and consistent line ratios are mathematically identified as structural clones in milliseconds.

Never. The AST entropy engine, Shannon entropy calculator $H(X) = -\sum P(x_i)\log_2 P(x_i)$, cryptographic inventory, and PDF generator run 100% in local memory on your machine. The only optional network request (cached in a local SQLite database aegis_ast_cache.db) queries the public vulnerability database api.osv.dev solely with the name and version of public packages declared in your manifests.

Unlike generic templates found online, AEGIS-AST compiles surgical rules specific to your repository: it explicitly lists existing functions to reuse (stopping AI duplication), files where exceptions are swallowed, phantom or hallucinated packages to ban, and cryptographic primitives mandated by your security policy. Simply drop these files at the root of your repository to immediately constrain Cursor, Claude Code, and GitHub Copilot.

Yes. EU Regulation 2024/2847 (Cyber Resilience Act) mandates a machine-readable Software Bill of Materials (SBOM) covering dependencies and known vulnerabilities (Art. 13), as well as cryptographic security documentation. AEGIS-AST generates a JSON file compliant with the official OWASP CycloneDX v1.6 schema combining both the SBOM (PyPI/npm components with PURLs and OSV.dev CVEs) and the CBOM (Cryptographic Bill of Materials classifying primitives against NIST FIPS 203 / 204 post-quantum standards).

Thanks to in-place build/cache directory pruning, algorithmic AST subtree size bucketing, and asynchronous semaphore-controlled registry checks, a 175,000-LOC repository is fully audited in under 10 seconds on a standard workstation CPU.

Projects & Scans are 100% Unlimited across all tiers. Our offline HMAC-SHA256 cryptographic verifier supports 3 architectures:

• SOLO Mode (€149 excl. VAT — One-time): Key format SOLO|COMPANY|HWID1,HWID2|SIG covering up to 2 workstations (your Desktop + your Laptop).
• TEAM / SMB Mode (€390 excl. VAT — One-time): Pack covering up to 5 developer workstations (TEAM|COMPANY|HWID1..5|SIG).
• ENTERPRISE & CI/CD Mode (€790 excl. VAT — One-time): Certificate ENTERPRISE|COMPANY_AND_TAX_ID|UNLIMITED|INVOICE_ID|SIG with zero hardware HWID lock so it runs across all workstations of the legal entity as well as ephemeral Docker / GitHub Actions / GitLab CI containers, with indelible corporate watermarking on every exported PDF and CycloneDX 1.6 SBOM.

Your engineers ship 3x faster with Cursor & Claude. Who audits your AI technical debt and EU CRA compliance?