Two AIs argue. One verdict.
Real numbers, not benchmarks. Audison audited httpx v0.28.1 (14,000+ Stars) across 10 security-critical functions using EmpiricalVerifier (AST static analysis — a utility distinct from Audison's multi-model adversarial audit).
| CONFIRMED | REFUTED | False Positive |
|---|---|---|
| 4 | 4 | 1¹ |
¹
_get_client_noncewas an AST false positive (indirect variable assignment untraceable), excluded after manual review. One UNCERTAIN excluded:_build_auth_headersame-name ambiguity, a tool limitation, not code uncertainty. Full report →
pip install audison && audison scan .Example output: scanning Audison itself → 0 CONFIRMED, 43 REFUTED [full output →](docs/terminal_output.txt)
Audison Scan — 维度4 数据完整性实证验证
扫描目录 D:\HANAKO\audison
发现文件 104 个源文件 / 审查函数 83 个
CONFIRMED 0 (真阳性)
REFUTED 43 (假阳性)
UNCERTAIN 40 (需人工复核)
A single model can't discover its own blind spots. Same training data, same biases — one person grading their own homework. Audison makes two models argue: one audits, another attacks from 5 adversary perspectives, a third cross-validates. Consensus comes from surviving attack, not from agreeing to agree.
Same AI-generated auth code, four reviewers:
| Finding | Standard AI Review | CodeQL | Shannon | Audison |
|---|---|---|---|---|
| SQL injection in login | Missed | Missed | Missed | Found |
| Hardcoded JWT secret | Warning | Missed | Missed | Found |
| Missing rate limiting | Missed | Missed | Missed | Found |
| CSRF token bypass | Missed | Missed | Missed | Found |
Input Code
│
▼
[ Brain One ] ──── Primary audit (security, correctness, logic)
(GPT-4o)
│
▼
[ Opponent Brain ] ──── 5 adversarial perspectives attack findings
(Claude Sonnet)
│
▼
[ Brain Two ] ──── Cross-verification: consensus → confirmed,
disagreement → UNCERTAIN (not hidden)
│
▼
[ TrustReport ] ──── Verdict + Confidence + Findings + SHA-256 chain
pip install audison
audison scan . # EmpiricalVerifier: AST static analysis
audison audit . # Full multi-model adversarial audit
# Set API keys (two providers recommended for cross-arbitration):
export OPENAI_API_KEY="sk-..."
export ANTHROPIC_API_KEY="sk-ant-..."| Feature | Audison | Standard AI Review | CodeQL | Shannon |
|---|---|---|---|---|
| Open Source | Yes | — | Yes | No |
| Multi-model Arbitration | Yes | No | No | Yes |
| Adversarial Review | Yes | No | No | No |
| Uncertainty Transparency | Yes | No | No | No |
| Verifiable Evidence Chain | Yes | No | No | No |
| Cost | Free; your API keys | Free | Free | Subscription |
audison/
├── src/audison/
│ ├── engine/ # TrustEngine — standalone audit layer
│ ├── brains/ # Brain One, Brain Two, Opponent Brain
│ ├── core/ # Caching, context, session management
│ └── utils/ # LLM client (8 providers), token counter
├── tests/unit/ # 186 unit tests
├── reports/ # Audit reports
├── docs/ # API, integrations, getting started
├── pyproject.toml
└── LICENSE
Apache License 2.0 — Copyright 2026 盛鑫
AI proposes. AI challenges. You decide.
Try it live: playground.html | GitHub Pages
详细文档见 docs/ — API 详解、MCP Server 配置、GitHub Action、LangChain/CrewAI 集成等。