SparkAE reads an assessment package, evaluates every “Determine if” objective through seven deterministic gates, and shows precisely what the evidence supports, contradicts, or fails to prove. Interview and Test stay with the assessor. No black box. The browser demo runs in this tab and uploads nothing; the server edition is built to run inside your boundary with no outbound calls by default.
Sample package · no signup · nothing uploaded · runs in your browser
Public preview This build runs the engine, not a recording. It reads the documents you give it and computes every determination in the baseline. Those determinations are automated EXAMINE preparation an assessor checks, not an authorization decision, and their accuracy rests on a small published case set rather than on real authorization packages — what the engine gets wrong is published beside what it gets right: the accuracy benchmark →. This describes the public build in this repository, not the commercial server product.
Every objective in the baseline gets a draft verdict and the evidence passage the engine used, before your team starts reading. Every ODP checked for a stated value, every draft finding cited to the document it came from, the same rules for every assessor on the team. Interview, Test, overrides, and the signature stay with you.
For Assessors → For cloud service providersRun your package against the same rules the assessor will use, before you pay for the assessor. Fix what the evidence cannot prove, then submit once.
Run it on the sample package →Browser demo: .zip, .docx, .txt, .md, .csv, .json, .xml, .nessus. PDF and XLSX text extraction is a server-product feature and is refused here, not guessed.
The browser demo runs FedRAMP Rev5 Low (156 / 981), Moderate (323 / 1,307), or High (410 / 1,429). FRAMEWORK=nist and the PM family are server-product install flags, not this repository.
Evidence presence → concept coverage → evidence strength → ODP validation → contradictions → temporal coherence → status. Examine only.
Per-objective verdicts with the passage cited, confidence (0–1.0), defensibility (A–F), gap type, and the correction — ranked by what blocks authorization first.
This build: OSCAL 1.1.2 assessment-results, findings / RET / POA&M / TCW CSV, summary, and the receipt. SAR/SAP DOCX, XLSX workbooks, and OSCAL POA&M ship only in the server product. Every export, listed →
The demo's other eight sections are guided walkthroughs of the rest of the FedRAMP lifecycle. They do not run the engine, they are labelled on the page, and they are listed under Under the hood.
This site loads no trackers, no analytics, and no third-party scripts or fonts. The engine, by default, makes no outbound calls. The browser demo assesses the package on your machine and uploads nothing.
Upload the package. The 7-gate engine traces each “Determine if” objective to the evidence passages the engine used and names the ones where it found none — with a confidence score and a defensibility grade.
The browser demo assesses FedRAMP Rev5 Low / Moderate / High. The commercial server product also installs as plain NIST 800-53 (FRAMEWORK=nist: those sets plus the PM family). FRAMEWORK= is not a flag in this repository. FedRAMP 20x support is not part of this product and is not sold — the 20x validation-assurance walkthrough illustrates the assessment question it poses.
Not the provider’s self-assessment tool, not the assessor’s in-house one. It reads the package rather than the running system: it retrieves, applies seven gates, and exports what it decided and why; your GRC tool tracks.
pip install . from this checkout does not work. LLM is always opt-in. When a model is on, it produces the determination directly; the 7-gate engine does not run alongside it.The deterministic 7-gate engine with ten local analytical services. BM25 retrieval, optional local ChromaDB.
An Ollama-served model produces the determination; nothing leaves the network. Not sold as SCIF-ready.
A cloud model produces the determination directly. Clearly flagged: those verdicts are not engine-grounded. The integrity gate (the published evidence floors) still applies.
This repository is the browser demo, not that install. Open demo-standalone.html. There is no Docker image and no /v1 API here.
Availability. The server product is not generally released yet. A fit call covers what is available today.
Availability. The server product is not generally released yet. A fit call covers what is available today. The browser demo on this site is available to everyone now.
The in-browser reference engine behind the live demo is published as source — see Source in the footer. Cloning that repository does not install the API above.
The public site is the browser demo. If you want to discuss whether the engine fits your assessment, request a fit call or email. This is a conversation — nothing on this page starts a paid Day-0 pilot.
SparkAE is independence-preserving assessment infrastructure. Where the target is FedRAMP it is not a FedRAMP Recognized independent assessment service (historically, a 3PAO), it does not replace one, and it does not make the authorization decision or issue the official Security Assessment Report or an Authorization to Operate. The recognized assessment service controls scope, testing, conclusions, overrides, and the final deliverables; the authorizing official makes the authorization decision. FedRAMP 20x support is not part of this product and is not sold. Licensing: the in-browser reference engine published at the Source link is Apache-2.0; the SparkAE server product is commercial software, licensed, not sold — federal buyers: commercial computer software under FAR 12.212 and DFARS 227.7202-1 through 227.7202-4, acquired under the licence customarily provided to the public.