Model Eval Sandbox Guard

• [Orchesis](https://orchesis.ai/scan) offers a free, open-source, browser-based AI-agent configuration scanner covering Docker, network, permissions, MCP, and IDE configuration. A new product cannot win by claiming “more checks.”
• [AgentSeal](https://agentseal.org/) covers prompts, MCP servers, skills, and runtime surfaces; [Cisco AI Defense](https://cisco-ai-defense.github.io/docs/ai-security-scanner) has enterprise trust and IDE distribution.
• [SecureBench](https://www.securebench.org/) already targets agentic benchmark answer isolation, dual sandboxes, egress rules, and trusted scoring, making it the closest conceptual competitor.
• [Trivy](https://www.trivy.dev/) and Checkov cover general IaC and container misconfiguration; this product must not duplicate their complete rule sets.
• [HopX](https://www.hopx.ai/) and Declaw sell secure runtimes rather than independent verification. They are both alternatives and potential future partners or recommendations.
• The proposed gap is verifying that a model-evaluation sandbox's declared boundary matches its observed boundary, combining configuration-line evidence with safe probes and focused remediation for package proxies, egress, answer isolation, and credentials. This gap is still observed + inferred, not payment-validated.

MVP Checklist

1. 1.Define the threat model, supported files, 25–35 rules, severity criteria, and safe fixtures; write rule tests first.
2. 2.Build ZIP/text input, parsing, line mapping, secret masking, and static findings.
3. 3.Build the Result UI, evidence/remediation presentation, and Markdown/JSON/SARIF exports.
4. 4.Build the safe probe, versioned result schema, upload/merge flow, and static/runtime mismatch logic.
5. 5.Build Home, Example, About, FAQ, and privacy/liability copy.
6. 6.Add the `$99 paid pilot` Payment Link and funnel events.
7. 7.Run build, fixture regression, size/format error, mobile, and SEO checks before launch.