Warrent

Inspiration

I asked an LLM how many critical CVEs a package had, and it just made up a number. So I ran the same question past 25 Nebius-hosted models. The answers ranged from 0 to 100, and not one of them could show where it got that.

What it does

Warrent answers supply-chain questions about your dependencies and backs every answer with a receipt: the SQL it ran plus the actual CVEs. If it can't be sure, it says so instead of guessing.

How we built it

It runs on Emergence CRAFT for schema-aware text-to-SQL over deps.dev advisory data, with Nebius Token Factory models on top. A thin deterministic layer reads CRAFT's own stated assumptions and grades each answer into three tiers. ANSWER when the data holds up, QUALIFIED when it had to substitute a field (and it flags which one), and ESCALATE when the data just can't answer and a human should. Answers replay from a live capture so you can reproduce them.

Challenges we ran into

CRAFT was slow, around 30 seconds a query, and rate-limited, so I built a record/replay cache to get around it. I started with PASS/FLAG/BLOCK verdicts and killed them, because a CVE count can't really justify "don't ship." At one point I caught myself rigging the baseline with a "be confident" prompt, swapped in a neutral one, and the models still scattered 0 to 100. Solo build, so all of this was me arguing with myself.

Accomplishments that we're proud of

The head-to-head is fair and you can't rig it. 25 models scatter across 0 to 100 with nothing auditable, and Warrent gives you one answer with a receipt. Honestly the part I like most is that the agent defers when it doesn't know, instead of guessing.

Built With

• emergence-craft
• mcp
• nebius-token-factory