Fabraix Red Team Playground
Free · Open source
AI security researchers
Legibility Field Kit
FreemiumOpen SourceSelf-Hosted
Governance logs full of 'the team approved it' and timestamps with no witness are not oversight — they are paper trails that collapse under the first audit. The Legibility Field Kit exists to catch exactly that before the auditor does.
Similar tools
Fabraix Red Team PlaygroundFreeFabraix Red Team Playground is an open-source, MIT-licensed testing environment structured…
EclusiaFreemiumEclusia runs locally on your machine and replaces names, IBANs, phone numbers, API keys, and…
Patronus ScannerFreemiumPatronus AI positions itself as evaluation and monitoring infrastructure for production LLM…
ArgotFreeArgot runs statistical checks against your repository's own commit history to flag code that…
Get This Tool
License: Apache-2.0 Any use incl. commercial
Local-run terms: Run, modify, and distribute the Python source under Apache 2.0 terms.
Summary
The kit is a zero-dependency Python CLI that runs three checks against your AI decision records: does every change name a specific human owner, is time-to-reverse recorded for reversible actions, and does each entry carry a complete OTW receipt — Owner, Time, Witness. Run `audit` against a directory of governance files and it surfaces every defect in seconds. The scoring command turns those findings into a maturity grade across the three tests, giving compliance teams a number to track sprint over sprint. The wall appears fast: the kit reads files, flags gaps, and stops — it does not integrate with your ticketing system, your CI pipeline, or your approval workflow.
Bottom line: Reach for this when you need to prove your governance files are not theater; look elsewhere when you need the tool to enforce accountability at the point where decisions are actually made.
Find your fit
Before you choose Legibility Field Kit
More options in Guardrails & Safety. Compare pricing, platforms, and features side by side.
Eclusia
Freemium
Legal professionals handling confidential cases
Pros
- Zero external dependencies, so the tool runs in an air-gapped or locked-down environment without a dependency audit of its own — which means regulated teams do not have to clear a supply-chain review just to use the auditor.
- The `init` command scaffolds governance files before a system goes live, so teams start with compliant structure rather than retrofitting it after a finding.
- OTW receipt detection — Owner, Time, Witness — catches the specific pattern where 'the team' or 'engineering' appears in the owner field, which is the defect that makes approval records legally meaningless under most accountability frameworks.
- Apache-2.0 license with self-hosted option, so your governance records and their audit results never leave your own infrastructure — critical when the files themselves contain sensitive decision rationale.
- Maturity scoring across three discrete tests gives compliance leads a metric that moves, so governance improvement has a number attached rather than being a qualitative assertion.
Cons
- The kit audits files that already exist — if your team's governance process lives in Jira tickets, Confluence pages, or Slack threads rather than structured files in a directory, there is nothing for the tool to read, and the first project becomes manually exporting records into a format the CLI can parse.
- There is no CI integration, webhook, or pre-commit hook provided out of the box, so the audit runs when someone remembers to run it; teams that need enforcement at the moment a decision is logged — not after the fact — add their own pipeline glue, at which point they are maintaining that integration themselves.
- The repository shows two stars and a single commit at time of listing, which means community-tested edge cases, maintained issue trackers, and peer-vetted documentation are absent; teams with complex governance schemas that do not match the demo structure have no community forum to consult and will be reading source code to understand behavior, which pushes some teams toward building a custom linter in-house instead.
About
- Platforms
- Python
- API Available
- No
- Self-Hosted
- Yes
- Last Updated
- July 11, 2026
Best For
Who it's for
- AI governance and compliance teams
- Organizations requiring auditable human oversight
- Developers maintaining decision records for regulated systems
What it does well
- Audit AI decision logs for human accountability
- Scaffold governance files for new systems
- Score governance maturity on three legibility tests
- Detect theater-style approvals lacking named owners or witnesses
Frequently Asked Questions
- Is Legibility Field Kit free?
- Legibility Field Kit offers a free option alongside paid upgrades. Check the current allowances and terms before choosing a plan.
- Is Legibility Field Kit open source?
- Yes. Legibility Field Kit is open source.
- Can I self-host Legibility Field Kit?
- Yes. Legibility Field Kit supports self-hosting on your own infrastructure.
- What platforms does Legibility Field Kit support?
- Legibility Field Kit is available on: Python.
Curated lists that include this category
Most AI governance processes fail the same way: approval records name a role or a team instead of a person, reversible actions ship without a rollback window documented, and the witness field is blank or missing entirely. The Legibility Field Kit is an open-source CLI auditor — Apache-2.0 licensed, no external dependencies — that runs three legibility tests against your existing governance file structure. The core workflow is three commands: `init` scaffolds compliant governance files for a new system, `audit` walks a directory and emits a finding for every violation of the owner, reversibility, or OTW (Owner, Time, Witness) rules, and `score` grades the system’s governance maturity across those three axes.
The differentiating design choice is what the tool refuses to do. It performs static checks on files you already maintain — it does not act as an agent, does not call external APIs, and carries zero runtime dependencies. That means there is nothing to provision, no credentials to rotate, and no vendor call path that breaks when a third-party service has an outage. The audit of a demo system runs in under a minute from a fresh clone.
The kit fits teams that already produce governance artifacts — decision logs, change records, approval files — and need a repeatable, auditable way to prove those artifacts meet a legibility standard. It fits regulated environments where a named human must sign off on AI-touched decisions and that signature must be verifiable. It breaks when the problem is upstream: if your process does not yet produce structured governance files, the kit has nothing to audit. The vendor offers a commercial kit at forgedculture.com for teams that need extended capabilities beyond the open core.
The repository ships with a `demo_system` directory and a `check.sh` script so the audit command produces real output against a sample set of files on first run. The PDF `ThreeTests_LegibilityFieldKit.pdf` documents the three-test framework the scoring logic implements, which is the artifact compliance teams are most likely to present to an external auditor.
Contribute
- Work on Legibility Field Kit? Claim this listing.
- Embed a badge for your README or site.
Sign in to rate this tool or suggest an edit.