MMP Software
Software we’re building, in the open about status.
Examples of what our software does — and exactly where each one stands.
- PASSSite audit: 22 pages, 0 errors0.8s
- PASSOWASP scanner: 0 high, 0 critical findings1.1s
- PASSParity: sitemap ↔ disk ↔ canonicals0.4s
- HOLD1 draft page below standard → pulled0.6s
- WAITRelease notes to owner before deploy—
Live
Site Auditor
Crawl your whole site — get plain-language problems
Site Auditor checks SEO, accessibility, security headers, performance and broken links. Free homepage check available now.
- Meta tags, canonicals, structured data (JSON-LD)
- Heading hierarchy, image alt text, color contrast
- CSP, HSTS, Referrer-Policy, Permissions-Policy
- Core Web Vitals signals, render-blocking resources
- 404s, redirect chains, orphan pages
How it works
- Enter URLWe crawl up to 500 pages from your sitemap.
- Automated checks200+ rules across SEO, a11y, security, performance.
- Plain-language reportEach finding: what failed, why it matters, how to fix.
- Prioritized fix planRanked by impact and effort. You approve the order.
Live
Universal Translator
114 languages, every request scanned and verified
51 human languages, 63 computer languages. 3,213+ translation pairs. Local-first engine — runs on your infrastructure, not a third-party cloud.
- 51 human languages — English, Chinese, Spanish, Hindi, Arabic, French, German, Japanese, Russian and 42 more
- 63 computer languages — Python, JS/TS, Rust, Go, C/C++, Java, SQL, YAML, Terraform, Dockerfile and 53 more
- Auto language detection — a wrong source selection is detected and corrected on its own
- Roundtrip verification — every translation is back-translated and scored before it is returned
- Chunked long-form handling — documents longer than one prompt are split and reassembled
- Self-improving — approved corrections become few-shot examples for that language pair
Security built in
- Sentinel input scan — every request is checked against the shared 205-rule threat library (OWASP Top 10:2025 + threat-content indicators) before the model sees it
- Inputs are data — text is only ever concatenated into a prompt and JSON-encoded; the codebase contains no eval, exec, compile or subprocess, and user text never reaches a shell
- Report-only — the scan returns findings, never blocks, never executes; the human decides
- Loopback-only engine — the model binds to 127.0.0.1; nothing leaves your machine unless you configure it to
- Hard limits — 10,000 characters per request, typed request schemas, CORS restricted to the service origin
API surface
- GET /api/v1/languages — the full language registry
- POST /api/v1/translate — translate with auto-detection, chunking and roundtrip verification
- POST /api/v1/security/scan-input — report-only threat scan of any text
- POST /api/v1/feedback — rate a translation; approved corrections train future prompts
- GET /api/v1/health — engine status
Engine
- Model: Qwen3 8B served by a local Ollama runtime on 127.0.0.1
- Chain-of-thought disabled for translation — lower latency
- Model kept warm between requests — no cold reload per call
- Deployment: your infrastructure; no third-party cloud
Live · v1.0
OWASP Top 10 Code Scanner
40+ checks across all ten OWASP Top 10:2025 categories
Reads code and configuration only. Produces HTML and JSON reports plus a design-review checklist.
- A01: Broken Access Control — 5 checks
- A02: Cryptographic Failures — 4 checks
- A03: Injection — 7 checks
- A04: Insecure Design — 3 checks
- A05: Security Misconfiguration — 5 checks
- A06: Vulnerable & Outdated Components — 4 checks
- A07: Identification & Authentication Failures — 4 checks
- A08: Software & Data Integrity Failures — 3 checks
- A09: Security Logging & Monitoring Failures — 3 checks
- A10: Server-Side Request Forgery — 2 checks
Output artifacts
- HTML report with severity, location, remediation
- JSON report for CI/CD integration
- Design-review checklist for architects
Scanner runs read-only. No code is modified or sent externally.
Live
Sentinel
Full defensive monitoring — hourly
Baseline integrity, Sigma rules, deep memory scan, MBR/ETW audit, foreign-install detection. Runs on your machine, reports to you.
- Baseline hash integrity (files, registry, tasks, services)
- Sigma rule matching (200+ rules, MITRE ATT&CK tagged)
- Deep memory scan (RWX, shellcode, injection patterns)
- MBR/partition table integrity
- ETW trace analysis (process tree, network, file ops)
- Foreign-install detection (new programs, scheduled tasks, services)
Zero resident footprint
Sentinel loads, scans, reports and unloads. Elastic on-demand only — no background process holding RAM. Runs as a short‑lived process, uses minimal CPU and memory during scans, and reports findings via an encrypted channel to your dashboard.
In development
Supply-Chain Scanner
OWASP A03 coverage — SBOM, vulnerabilities, pipelines, AI agents
Generates a Software Bill of Materials, finds vulnerable/unpinned/tampered components, risky CI/CD pipelines and AI-agent instruction files, then produces a fix plan you approve.
- SBOM generation (CycloneDX, SPDX)
- Vulnerable dependency detection (OSV, GitHub Advisory)
- Unpinned / floating version detection
- Tamper detection (hash mismatch, supply-chain compromise)
- Pipeline risk analysis (GitHub Actions, GitLab CI, Azure Pipelines)
- AI-agent instruction file scanning (system prompts, tool definitions)
Fix plan you approve
Every finding includes: current version, fixed version, breaking-change risk, test coverage needed, estimated effort. You review and approve the order before any change is made.
Consult-first
Website Rebuilder
Internal tool — advertised as a design service
The Website Rebuilder is an internal tool we use to audit, rebuild and deploy client sites with AI behavioral training built in. It is not a self-serve product.
- Full site audit (SEO, a11y, security, performance)
- AI behavioral training spec per page/component
- Rebuilt with unified design system (Geist + Instrument Serif)
- Lattice hero background on every page
- Verification receipt on deploy
How to engage
Start with your business. We'll assess your current site, produce a Presence MRI, and propose a rebuild scope with acceptance criteria. Nothing is built before the blueprint is signed.
Want to use our software?
Live tools are free to try. In-development tools get early-access for clients.