Software assurance · Open source

MethodAtlas

A source-level map of what a test suite actually contains, enriched—when useful—with security classification, control mapping and review evidence. The deterministic inventory remains separate from AI interpretation so the result can be inspected and reproduced.

8languagestest discovery across mainstream, scripting and enterprise languages
SARIF 2.1CI outputfirst-class integration with security and developer tooling
170+credential patternsdeterministic secret-candidate catalog before optional AI triage
Signedevidence packstamper-evident review bundles with classical, PQC or hybrid signatures

From source code to defensible evidence

A successful test run answers whether tests passed. Assurance work asks a different set of questions: Which tests exist? Which ones exercise security properties? Which controls do they support? What changed since the last review? Can the evidence be reproduced? MethodAtlas is built around that gap.

Source treeexisting test code→ Discoverydeterministic parsers→ Enrichmentoptional AI & taxonomy→ Reviewoverrides & drift checks→ EvidenceSARIF · coverage · signed packs

The architecture deliberately makes method discovery a structural source-analysis problem, not an AI problem. AI can classify security relevance, suggest tags or help triage findings, but it is an explicit enrichment stage layered over a deterministic inventory.

Eight languages, one evidence model

JavaJUnit 5 · JUnit 4 · TestNGAST discovery · source write-back
C#xUnit · NUnit · MSTestgrammar-based discovery · source write-back
TypeScript / JavaScriptJest · Vitest · Mochaplugin discovery
Gotesting packageplugin discovery
Pythonpytestplugin discovery
PowerShellPesterplugin discovery
SAP ABAPABAP Unit · ecATTenterprise test inventory
COBOLMFUnit · COBOL-Checkenterprise test inventory

The language plugins produce a common method-level record. That common shape lets the assurance workflow stay consistent even when a portfolio spans modern services, scripts and long-lived enterprise platforms.

Evidence capabilities, not just classification

Security taxonomy

AI-assisted classification can map tests to a closed versioned security taxonomy or a custom taxonomy aligned with the organisation's own control framework.

Confidence and review queues

Per-method confidence scores support thresholds and human-review queues instead of forcing a binary “AI says yes/no” operating model.

Content fingerprints

SHA-256 source fingerprints let teams identify unchanged classes, reuse prior AI results and demonstrate whether evidence came from the same test content.

Delta reports

Two inventories can be compared to show methods added, removed or modified—useful for release evidence and CI regression gates.

Control coverage

Tags can be mapped to user-supplied control identifiers so the output highlights coverage gaps rather than treating raw test counts as assurance.

Reproducibility receipts

Inputs that influenced a scan—including effective LLM prompt templates—can be fingerprinted so a future reviewer can reconstruct what produced the result.

AI is optional—and bounded

MethodAtlas supports local Ollama inference, cloud providers and a two-phase manual workflow for environments where source code cannot be sent to an external API. Human-reviewed overrides are persistent, and the source-writing workflow is deliberately separate from classification so changes can be reviewed before they reach code.

01
Deterministic baseline

Discover test methods, framework metadata, locations and source identity without an LLM.

02
Optional interpretation

Add security relevance, taxonomy tags, rationale and confidence using local, cloud or manual AI.

03
Human authority

Review, override and persist decisions; detect drift between source annotations and later classification.

04
Auditable output

Emit CI-friendly records, control coverage, receipts or tamper-evident evidence packages.

Credential detection as a separate deterministic signal

The same assurance pipeline can look for credential candidates in source. Candidate discovery uses a curated deterministic rule catalog with more than 170 vendor credential formats; values are masked by default. AI, when enabled, is used downstream to estimate credibility and relate a candidate to the endpoint it appears to authenticate against—not to invent the underlying match.

Why the separation matters. In a regulated review, “the model found it” is weak provenance. MethodAtlas keeps deterministic discovery, optional probabilistic interpretation and human decisions as distinguishable stages so each can be challenged independently.

Interactive review for people who do not want a CLI-only workflow

The desktop GUI provides a reviewer-oriented workflow around the same model: source browsing, syntax highlighting, class/method result trees, tag decisions, staged changes and batch write-back. Review actions create evidence CSV records and persistent override data so a GUI decision is not merely transient state on one workstation.

Staged source changes

Suggested annotations can be reviewed and staged in memory before a deliberate “Save All Changes” operation writes them back.

Audit trail

Review decisions are recorded as timestamped evidence and reusable overrides, preserving the distinction between machine suggestion and human decision.

AI profiles

Named provider profiles let an operator switch between local and remote inference without embedding that choice into the discovery engine.

Plugin selection

Discovery plugins can be enabled per run so a reviewer can narrow a heterogeneous repository to the languages relevant to the task.

Evidence packs and ZeroEcho

Evidence packs bundle the scan output into a tamper-evident directory with a SHA-256 manifest. When signing is requested, MethodAtlas can use ZeroEcho to produce classical, post-quantum or hybrid signatures. This is a practical connection between two Egothor engineering themes: discover assurance evidence, then protect the integrity of the evidence package itself.

Project lineage

MethodAtlas began with an open-source foundation developed by Egothor. Accenture later extended that foundation with additional capabilities, and the expanded public project is currently published in Accenture's GitHub organisation. This describes project lineage; it is not presented here as an institutional partnership or endorsement. The public project is licensed under the Apache License, Version 2.0.

Project resources