For security and compliance teams
What NeuralMind sends over the network, how to verify what you install, how to run it with no network at all, and the controls a regulated deployment turns on — each with the command that shows it.
Latest release
v4.19.0Released 2026-10-21Each container image is signed with cosign, keyless: the signature is bound to the release workflow’s GitHub identity and logged in Sigstore’s public transparency log. The image, wheel and sdist carry build-provenance attestations naming the workflow and commit that built them. The release workflow runs the same checks before :latest moves.
# The image signature
$ cosign verify ghcr.io/dfrostar/neuralmind:v4.19.0 --certificate-identity-regexp '^https://github\.com/dfrostar/neuralmind/\.github/workflows/docker-publish\.yml@refs/(heads/main|tags/v[0-9]+\.[0-9]+\.[0-9]+)$' --certificate-oidc-issuer https://token.actions.githubusercontent.com
# The image’s build provenance
$ gh attestation verify oci://ghcr.io/dfrostar/neuralmind:v4.19.0 --repo dfrostar/neuralmind --cert-identity-regex '^https://github\.com/dfrostar/neuralmind/\.github/workflows/docker-publish\.yml@refs/(heads/main|tags/v[0-9]+\.[0-9]+\.[0-9]+)$'
# A wheel or sdist you downloaded
$ gh attestation verify neuralmind-4.19.0-py3-none-any.whl --repo dfrostar/neuralmind --cert-identity-regex '^https://github\.com/dfrostar/neuralmind/\.github/workflows/release\.yml@refs/(heads/main|tags/v[0-9]+\.[0-9]+\.[0-9]+)$'
# The source tarball: compare with the SHA-256 on the release page
$ curl -sL https://github.com/dfrostar/neuralmind/archive/refs/tags/v4.19.0.tar.gz | sha256sum
VEX
Dependency advisories NeuralMind’s code can’t reach, each marked not affected with the reason. Pass it to Grype or Trivy with --vex.
SSDF
Every NIST SP 800-218 practice, mapped to the workflow, file or check that is its evidence.
SSDF mapping →By default, NeuralMind sends no telemetry and transmits no repository content off your machine. The complete list:
Telemetry
None — not opt-in, not anonymous. There is no telemetry mechanism in the product.
Embedding model, first build
An HTTPS download of the public all-MiniLM-L6-v2 model, verified against a pinned SHA-256 — on first build, and again only if the cached copy is removed. It carries none of your data, and pre-seeding the model removes it entirely for air-gapped installs.
Opt-in LLM seeding
Off by default. Only if you set NEURALMIND_LLM_SEED=1 and provide an Anthropic API key does it send README and architecture-doc prose — never source code — to seed synapse edges. Refused under security.profile: cui.
Audit forwarding
Off by default. If you set security.audit_syslog, each audit record goes to the syslog target you name; under security.profile: cui only a unix socket or loopback address is accepted.
Your agent’s own traffic
The context slice your agent sends to its model provider. NeuralMind makes it smaller; it does not control it.
Details: third-party LLM disclosure
Bundle the wheels and the embedding model on a connected machine with the target’s Python version, carry both across, and install with no index. With the model restored to its cache, the first build makes no network request.
# On a connected machine: the wheels, then warm the model cache
$ pip download neuralmind --dest ./offline-bundle
$ python -c "from neuralmind.onnx_embedder import OnnxMiniLMEmbedder as E; E()(['warm'])"
# Bundle the wheels and the cached model together
$ tar czf neuralmind-offline.tgz ./offline-bundle -C ~/.cache/neuralmind onnx_models
# On the air-gapped machine
$ tar xzf neuralmind-offline.tgz
$ pip install --no-index --find-links offline-bundle neuralmind
$ mkdir -p ~/.cache/neuralmind && cp -r onnx_models ~/.cache/neuralmind/
# Or point at a model directory you manage (model.onnx and tokenizer.json)
$ export NEURALMIND_ONNX_MODEL_DIR=/opt/models/all-MiniLM-L6-v2/onnx
The full procedure, platform pinning and verifying the bundle before it crosses: running air-gapped →
Each is free at one seat, like every feature. A version tag says which release a control shipped in.
security.profile: cui in neuralmind-backend.yaml switches on OS-account identity, refuses an unencrypted disk, refuses serve beyond loopback or without its token, and refuses LLM seeding even when switched on. Each refusal lands in the audit log; a contradictory or misspelled profile fails closed. An administrator’s machine policy keeps it on.
$ neuralmind doctor . # checks the profile as a unit; fails when the OS FIPS mode is off
17 rules, each mapped to the SP 800-53 Rev. 5 controls it supports: the security profile and machine policy, OS identity, file permissions, verified encrypted storage, the OS FIPS mode, the daemon, the audit log’s chain, signed and anchored checkpoints, and forwarding with nothing waiting. A rule that can’t be checked fails.
$ neuralmind hardening . # exits 1 when any rule fails
Set security.audit_syslog and every audit record goes to syslog right after it is written, from the CLI, the MCP server, the hooks and the daemon, with its hash so the SIEM can check the chain. A record that can’t be written raises an alert-severity message at once. Records a dead target missed are sent when it is back.
$ neuralmind audit forward . # send what is waiting, on demand
Every query, build and admin change is logged with its actor in an append-only SHA-256 hash chain. Signed checkpoints, anchored where the developer can’t write, make removing the newest records or recomputing the chain fail verification.
$ neuralmind audit verify .
$ neuralmind audit checkpoint .
$ neuralmind audit export . --format cef -o audit.cef
Reports credentials in the files a build would index, so they can be removed and rotated before they reach the index, a commit or an agent’s context. build --redact-secrets is a backstop for indexed text, not a substitute for rotating a key.
$ neuralmind scan-for-secrets .
Lists every location NeuralMind writes for a project, in it and outside it, and the integrations that write them — each with what it holds and the command that removes it. Read-only; for retention reviews and erasure requests.
$ neuralmind data-locations . --json
NeuralMind provides evidence your reviewers can map to controls; whether a deployment meets a framework is decided by assessing that deployment. NeuralMind itself holds no certification.
SP 800-53 OSCAL component definition
The 21 SP 800-53 Rev. 5 controls NeuralMind touches, what it implements for each and what stays yours, as OSCAL 1.1.3 a GRC tool can import into a System Security Plan.
NIST: what applies, and where it stands
Which NIST documents you’ll be asked about — SSDF, SP 800-171 and CMMC Level 2, SP 800-53, FIPS 140-3, the AI RMF — depending on who you are, and where NeuralMind stands on each.
NIST overview →Framework mappings for GDPR, SOC 2, CMMC 2.0, HIPAA, ISO 27017 and NIST AI RMF, and the audit trail, SBOM and hash chain behind them: COMPLIANCE-SUMMARY.md. Next audit target: a SOC 2 Type I report, Q3 2027.
No externally reported vulnerabilities to date. Issues found internally are fixed and called out in the release notes, and advisories against third-party dependencies are tracked with a written, reachability-based disposition in SECURITY.md.
Found something? Responsible disclosure is welcome — see SECURITY.md for how to report it.