Open workbench
Menu

Evidence-backed content trust

Evidence for deciding how untrusted content may be used.

Safe to open is not safe to index, and neither is safe to hand an agent. The same file deserves a different answer depending on what happens next — so PayloadGlass analyses it locally, shows the evidence behind the answer, and says plainly what it could not check. Built first for content that reaches automated consumers: agent tool use, build sandboxes and RAG ingestion.

Prerelease The workbench and the sis binaries are free to use today; what is stable and what is still being built is marked on every surface and on the roadmap.

Prerelease (pre-1.0). sis 0.70.0 is the current release; output formats, findings, verdicts and commands may change between versions while we collect feedback.

Open the investigation workbench → Install the sis CLI

Your file stays in the browser. No account. No upload. User file-content egress: 0 bytes.

0 bytesof your file leave the browser
Recursivecontent-aware structural analysis
Unknown ≠ cleancoverage gaps are reported as gaps, not as a pass — lane by lane, as the coverage page states

Start with intended use

Start with what happens next.

Pick what the content is actually for. Each of these opens a real analysis in your browser, showing the evidence that matters to that use — and what remains unknown for it.

Open it Inspect active content, deception and coverage before a person opens it. Explore this case → Render it Assess parser, renderer and active-document risk before software consumes it. Explore this case → Index it in RAG Expose hidden instructions, retrieval-only channels and sensitive data before indexing. Explore this case → Give it to an agent Inspect content that may influence tools, memory or automated actions. Explore this case → Forward or release it Review sensitivity, evidence coverage and available derivatives before release. Explore this case → Expand the archive Walk nested members as one bounded asset graph and surface skipped or encrypted content. Explore this case → Transform it Generate safe text or plan a supported sanitise and verify-rescan workflow. Explore this case →

How the evidence is built

From bytes to evidence you can defend.

A verdict on its own is not much use. What matters is the chain that produced it: what the content is, what it can do, how strongly that is known, who is about to consume it, and what the analysis never managed to look at.

  • How did it arrive? Sender, origin, repository revision, sharing scope, quarantine state and custody. The same bytes can deserve a different answer depending on where they came from.
  • What is it really? Accepted interpretations of the bytes are retained and analysed (alternate-view enumeration is still being hardened), and nested assets are expanded under explicit budgets. A polyglot signature alone never convicts. (Identifying content from bytes rather than extensions is the baseline, not the claim.)
  • How strongly is that known? Evidence carries its derivation and completeness, not just its conclusion. Verdicts decompose into named contributions, and near-misses, demotions and suppressions stay traceable.
  • What can it actually do? Capabilities are being mapped across carriers into effects — execution, external retrieval, disclosure, coercion, machine influence. Partial: bounded and diagnostic today; no verdict or decision uses them yet.
  • Who is about to consume it? A reader, a renderer, a retrieval indexer and a tool-using agent are exposed differently by the same capability.
  • What was never looked at? Skipped providers, encrypted members and unsupported surfaces are reported as coverage gaps that qualify the decision. Budget exhaustion is being brought onto the same footing — see the note below.
Inspect the evidence in your browser →

How the analysis actually works: effects, consumers, custody and external integrity evidence →

What we tell you that a score does not

Measurement honesty, not a better number.

Many tools can say they inspect files for hidden instructions. The harder part is saying how much of the content the answer actually covers.

Coverage in the verdict

Where a format has a member producer, an unopenable or skipped member is part of the answer, not a note beside it. Where it does not, the report says so rather than implying completeness.

Plural interpretation

The default type model keeps every accepted reading of an ambiguous file and analyses each one, rather than committing to a single guess.

Omissions you can query

Skipped, unsupported, failed and budget-limited work is a field in the machine-readable output, not a log line.

Derivatives with a receipt

A safer derivative records what was removed and what could not be established, and can be re-scanned as its own subject (verify-rescan).

Known limit, stated here because it matters: some analysis budgets do not yet record their own exhaustion, so a clean-looking report is not yet a guarantee that every lane ran to completion. Closing that gap is in the current work. We also intend to publish a conformance corpus with expected verdicts, including cases whose correct answer is unmeasured Roadmap.

Browser Investigation Workbench

Investigate a file right now, in this tab.

The production engine compiled to WebAssembly, running in a Worker on your own machine — the same SIS engine and semantic contracts the CLI uses, with environment-specific support and coverage disclosed rather than assumed. And your file's content is never uploaded. Nothing to install, nothing to sign up for.

Summary

Orientation and the top-level conclusions.

Structure

Interpretations, assets and nested structure.

Evidence

The supporting observations and findings, inspectable.

Use

Advisory destination and use context, plus recovered content.

Actions

Requestable local work, with real operation state — requested, running, completed, failed, cancelled or refused.

Alongside those, narrower inspectors: Custody Integrity Lineage Analysis identity Limits — because custody, integrity and lineage are different questions with different evidence, and collapsing them into one tab hides that.

The engine starts lazily, declares its own limits and refuses work it cannot bound. Operations carry real state — requested, running, completed, failed, cancelled or refused — bound to an exact revision. Snapshots can be compared with explicit comparability rather than an invented better/worse ranking. On-device persistence is optional, off by default and removable, and no user file content is transmitted.

Open the workbench →

Transform with explicit limits

Hand your model the text, not the payload.

Safe text projects selected textual channels into a model-facing safer derivative and emits a removal log. Native sanitisation is a preview for selected formats and is not a guarantee that active or embedded content is removed. This reduces specified channels and exposure — it does not certify that the result is harmless, and support and fidelity are always format-specific.

  • Safe text ships today. Visible and selected structural text are preserved; prohibited or hidden channels are omitted with evidence.
  • Native sanitisation is a preview. Selected formats only; it is not a guarantee that active or embedded content is removed, and the verified-release path is not in the 0.70.0 release.
  • No silent rewrite. The output records what changed, what was preserved and what could not be established.
Explore safe text

Where it runs

One engine, several surfaces.

The same analysis contracts feed every surface, so a finding means the same thing on the command line, in CI, in the browser and on the endpoint. Profiles are the same decision asked differently — AI Context is a profile, and safe-derivative handling is a capability of the same engine; neither is a separate product.

sis CLI

Shipping

Local native analysis, investigation, reporting, querying, explanation and selected, preview sanitisation — with machine output, batch and directory scanning, diagnostics and shell integration.

GitHub Action

Partial

Downloads a pinned, checksum-verified release binary and scans a file or directory in CI, publishing SARIF to code scanning and a JSON report. Linux x86_64 runners only today; end-to-end verification of a public invocation is still outstanding.

Agent skills — Claude Code and Codex

Partial

Free and local-only: skills that let an agent find, verify and run a local sis binary for a bounded scan, triage and corpus work. Pack v0.2.0 targets sis 0.70.0. No hosted option, no upload, no telemetry; a host that cannot run a local binary is unsupported. Not yet listed in any marketplace or directory.

Browser Investigation Workbench

Hardening

The production engine compiled to WebAssembly, running in a local Worker and projected into real investigation areas. Your file's content is never uploaded.

Guardian

Partial

Local monitored-folder and operator workflows with desktop and service surfaces, MCP integration, snapshot-bound acquisition, audit records and a transactional vault. Not packaged in the 0.70.0 release. Persisted automation authority and cross-platform polish are incomplete.

Gateway — target enterprise control point

Roadmap

The planned customer-deployed control point, not a second analysis engine: a thin connector acquires content and custody context, SIS analyses it, an optional policy-approved verifier runs, and one Content Trust Decision allows, constrains, reviews, refuses or transforms. Connectors supply context; they never grow their own integrity semantics.

Occurrence & campaign intelligence

Speculative

Reasoning across an estate over time: how equivalent effects rotate between carriers, versions, senders and campaigns while the underlying capability graph stays the same. Described generically — no product name is committed.

Maturity labels re-checked 2026-10-08. The engine ships. The enforcing decision layer above it is being built — the roadmap sets out the order and the maturity of each stage.

On your machine and in your pipeline

The same engine, on your machine or in CI.

The sis CLI is not a reduced edition: it runs the same analysis engine, on your machine, with no account and no upload. The GitHub Action runs that same published binary in CI over your repository or build artifacts — as does the container image, for hosts where you would rather install nothing at all.

  • Scan one file, many paths, or a whole directory
  • Fast triage by default, deeper profiles on demand
  • Emit several outputs from a single analysis pass
  • JSON, JSONL and SARIF for pipelines and code scanning
  • Query structure and evidence; explain a decision from its trace
  • Check readiness with sis doctor; install shell completions
Download sis 0.70.0 → Install options

macOS · Linux · Windows (CLI); the GitHub Action is Linux x86_64 only. Published through an artifact-only release path with provenance controls, so the publishing path never reaches source.

Prerelease (pre-1.0). sis 0.70.0 is the current release; output formats, findings, verdicts and commands may change between versions while we collect feedback.

Preferred — download a release archive and verify it

sha256sum -c SHA256SUMS --ignore-missing

Fetch the archive for your platform and SHA256SUMS from the release page, then check the digest before running the binary.

Convenience installer — inspect before running

curl -fsSL https://raw.githubusercontent.com/payloadglass/sis-release/main/scripts/install.sh | sh

For controlled environments use the verified download above or the container image.

Container — nothing installed on the host

docker run --rm --network none --read-only \
  -v "$PWD:/work:ro" ghcr.io/payloadglass/sis:v0.70.0 scan /work

linux/amd64 · linux/arm64, as one OCI index. Tags are release tags; there is no rolling tag. Pin by digest for reproducible runs.

In CI — JSONL on stdout, SARIF as a side artefact

sis scan ./artifacts --format jsonl --emit sarif=sis.sarif

The GitHub Action wraps this with a pinned, checksum-verified binary (Linux x86_64 runners).

Customer-deployed content trust

Design-partner programme for customer-deployed intake.

The Gateway is planned, not shipped. We are working with design partners on AI context, support-bundle intake, customer-deployed intake and local/agent workflows. Raw hostile or sensitive content remains in your environment.

Design-partner program. We’ll only email you about access — no list-selling, no spam.