Software assurance · Open source
MethodAtlas
A source-level map of what a test suite actually contains, enriched—when useful—with security classification, control mapping and review evidence. The deterministic inventory remains separate from AI interpretation so the result can be inspected and reproduced.
From source code to defensible evidence
A successful test run answers whether tests passed. Assurance work asks a different set of questions: Which tests exist? Which ones exercise security properties? Which controls do they support? What changed since the last review? Can the evidence be reproduced? MethodAtlas is built around that gap.
The architecture deliberately makes method discovery a structural source-analysis problem, not an AI problem. AI can classify security relevance, suggest tags or help triage findings, but it is an explicit enrichment stage layered over a deterministic inventory.
- Existing tests stay valuable because the tool inventories what already exists.
- AI remains optional rather than being the only way to get results.
- Review is explicit before tags or evidence are treated as authoritative.
- Output fits delivery pipelines through SARIF, CSV, coverage matrices and signed packs.
Eight languages, one evidence model
The language plugins produce a common method-level record. That common shape lets the assurance workflow stay consistent even when a portfolio spans modern services, scripts and long-lived enterprise platforms.
Evidence capabilities, not just classification
Security taxonomy
AI-assisted classification can map tests to a closed versioned security taxonomy or a custom taxonomy aligned with the organisation's own control framework.
Confidence and review queues
Per-method confidence scores support thresholds and human-review queues instead of forcing a binary “AI says yes/no” operating model.
Content fingerprints
SHA-256 source fingerprints let teams identify unchanged classes, reuse prior AI results and demonstrate whether evidence came from the same test content.
Delta reports
Two inventories can be compared to show methods added, removed or modified—useful for release evidence and CI regression gates.
Control coverage
Tags can be mapped to user-supplied control identifiers so the output highlights coverage gaps rather than treating raw test counts as assurance.
Reproducibility receipts
Inputs that influenced a scan—including effective LLM prompt templates—can be fingerprinted so a future reviewer can reconstruct what produced the result.
AI is optional—and bounded
MethodAtlas supports local Ollama inference, cloud providers and a two-phase manual workflow for environments where source code cannot be sent to an external API. Human-reviewed overrides are persistent, and the source-writing workflow is deliberately separate from classification so changes can be reviewed before they reach code.
Discover test methods, framework metadata, locations and source identity without an LLM.
Add security relevance, taxonomy tags, rationale and confidence using local, cloud or manual AI.
Review, override and persist decisions; detect drift between source annotations and later classification.
Emit CI-friendly records, control coverage, receipts or tamper-evident evidence packages.
Credential detection as a separate deterministic signal
The same assurance pipeline can look for credential candidates in source. Candidate discovery uses a curated deterministic rule catalog with more than 170 vendor credential formats; values are masked by default. AI, when enabled, is used downstream to estimate credibility and relate a candidate to the endpoint it appears to authenticate against—not to invent the underlying match.
Interactive review for people who do not want a CLI-only workflow
The desktop GUI provides a reviewer-oriented workflow around the same model: source browsing, syntax highlighting, class/method result trees, tag decisions, staged changes and batch write-back. Review actions create evidence CSV records and persistent override data so a GUI decision is not merely transient state on one workstation.
Staged source changes
Suggested annotations can be reviewed and staged in memory before a deliberate “Save All Changes” operation writes them back.
Audit trail
Review decisions are recorded as timestamped evidence and reusable overrides, preserving the distinction between machine suggestion and human decision.
AI profiles
Named provider profiles let an operator switch between local and remote inference without embedding that choice into the discovery engine.
Plugin selection
Discovery plugins can be enabled per run so a reviewer can narrow a heterogeneous repository to the languages relevant to the task.
Evidence packs and ZeroEcho
Evidence packs bundle the scan output into a tamper-evident directory with a SHA-256 manifest. When signing is requested, MethodAtlas can use ZeroEcho to produce classical, post-quantum or hybrid signatures. This is a practical connection between two Egothor engineering themes: discover assurance evidence, then protect the integrity of the evidence package itself.
Project lineage
MethodAtlas began with an open-source foundation developed by Egothor. Accenture later extended that foundation with additional capabilities, and the expanded public project is currently published in Accenture's GitHub organisation. This describes project lineage; it is not presented here as an institutional partnership or endorsement. The public project is licensed under the Apache License, Version 2.0.