01 / Account & access
Start with your own account.
Open your workspace and choose Create account. Verify your email before registering a project or connecting an agent. If you already have an account, Use an email code signs you in without a password. Each person uses a separate account.
Current availability: private pilot. Registration does not create a subscription or grant assessment access. Paid subscriptions are not yet open. You need an assigned preview or access to an active team workspace.
An owner-preview project may already be registered for you. Select it rather than creating a duplicate. Team members should accept their invitation using the email address that received it.
Check your account access02 / Your first project
Name the application you will assess.
In Projects, enter the product name and choose Add project. PRAE creates a project ID. Use that exact ID when setting up its runner.
One project covers one application and its related repositories, frontend, backend, and development, staging and production environments. An unrelated application uses another project slot. Registering a name does not discover a website or connect a cloud account; your approved project files supply the evidence.
| Plan | Annual price | People / projects |
|---|---|---|
| Individual | $399 | 1 person / 1 project |
| Team | $1,999 | 5 people / 5 shared projects |
Owners and administrators add and edit products in Projects. Assign people under People & access. Five projects is the workspace total. Exceeding an allowance is blocked; no surprise overage is charged. Additional-project purchases and self-service plan changes are not currently available. Larger workspaces require a quote.
03 / Choose your setup
Where does your application live?
The runner needs access to the files you approve. Choose the path that matches your working environment.
Use a local MCP runner.
Install the signed runner on the computer with your checkout. Approve a scope and add the generated MCP connection to a compatible coding assistant. Local maps stay on that computer unless you choose to share them.
Continue to installation →Collect where the files are available.
Export or synchronize the builder's project to a checkout you control, or use a private environment that can run the signed runner. Browser-only tools can review a shared snapshot through hosted MCP. Native runner support depends on the builder; connecting hosted MCP alone does not inspect unsynchronized editor changes.
Set up the collecting runner →Start from the deployed source revision.
Use an authorized checkout matching the release you want to assess. Include supported hosting configuration in its scope. Source findings describe that checkout. To establish deployed behavior, separately approve supported staging tests and deployment evidence. A public URL alone does not establish the stack or its protections.
Set up the assessment →Use the browser or hosted MCP.
Accept your workspace invitation, select an assigned project and open its private schematic. To review through an agent, add the hosted MCP URL below to a compatible client and authorize one project in the browser. If that client requires a manual credential, create an Agent · read shared evidence credential in MCP connections.
https://nullventures.co/api/platform/mcp
Save manual credentials in the client's secret settings. A viewer cannot obtain a runner license or upload evidence. Hosted review needs an existing shared snapshot.
Understand your evidence →04 / Install & connect
A one-time setup for each project.
In MCP connections → Runner release, download the runner package, installer, signed manifest, verification keys and license receipt into one folder. Downloads require verified project access and an available release. Use the five files from the same release.
Install the current owner-preview runner
Use Node 24.22.2 or a newer Node 24 release. Confirm the signing-key fingerprint through your approved release channel. Open a terminal in the download folder and choose a new installation directory:
node install-preview.mjs --archive nullventures-security-platform-0.3.0-preview.5.tgz --manifest null-security-release.json --trust null-security-trust.json --license null-security-license.json --directory ./prae-installation
Then check the installation:
node ./prae-installation/null-security.mjs doctor
The installer verifies the signed files before installation. The preview is for authorized internal evaluation. Its receipt expires within seven days.
Approve files and generate the MCP connection
Keep your evidence outside the application and installation folders. This starter example is for a Node project. Replace the quoted project path, project ID and owner name before running it. Choose input files that actually exist in your project; manifests alone do not produce a complete schematic.
node ./prae-installation/null-security.mjs scope draft \ --root "/absolute/path/to/project" \ --project "PROJECT_ID_FROM_WORKSPACE" --owner "YOUR_NAME" \ --environment development \ --input package.json --input package-lock.json \ --file ./prae-scope.json
Review prae-scope.json. Add the relevant source files, routes and hosting configuration you authorize, and review its declared features. Only proceed when that scope is correct. The next command initializes the evidence workspace and records your approval:
node ./prae-installation/null-security.mjs init --scope ./prae-scope.json --workspace ./prae-evidence node ./prae-installation/null-security.mjs mcp config --workspace ./prae-evidence --file ./prae-mcp.json
Add the generated command and arguments to a compatible local MCP client's server settings, then reconnect it. If it only supports remote servers, use the hosted-review path and collect with a runner elsewhere. The agent cannot approve additional files on your behalf. Installation and scope approval still require these operator steps.
05 / First assessment
Give your agent a clear first task.
Once the runner is connected, ask your coding assistant:
Profile this approved project and run its security assessment. Explain the highest-priority confirmed gaps separately from unknown or untested protections. Open the private infrastructure map and show the evidence behind the findings.
Choose one finding to work through. Ask for a correction plan and the separate test that would verify it. Review the change, implement it through your normal development workflow, then ask PRAE to reassess. A prepared correction does not deploy itself or close a finding.
If the assessment reports incomplete coverage, read what could not be checked. Missing evidence is not a passing result. Creating a key, downloading a package or opening a diagram does not establish that an assessment passed.
06 / Read the evidence
Open the map. Follow the finding.
Ask “Open the private infrastructure map and show me the sign-in journey.” A local runner returns a private link on the same computer. Your website workspace remains empty until you opt in to sharing a snapshot.
Show my schematic in the website
In MCP connections, create a credential with purpose Runner · share approved evidence. In that runner's private environment, set NULL_MAP_VIEW_MODE=hosted, NULL_MAP_PORTAL_ORIGIN=https://nullventures.co and NULL_MAP_RUNNER_TOKEN to the credential. Restart its connection, then ask it to open the map again. Keep the token out of prompts and source files.
This explicitly shares a generated snapshot containing approved relative filenames, routes, dependencies and control evidence. Open Overview → Open private schematic after sharing. The browser still checks your own account and project access; a copied link does not grant access.
Confirmed gap: a supported check found something missing. Needs evidence: the protection is unknown or untested. In configuration/source: a declaration was found; it is not proof of runtime behavior. Check the snapshot's date, scope and source revision.
Your first session is useful when you have a map of the approved project, a prioritized list of findings and unknowns, and a clear verification plan for one correction.
Open your project overview →Your project library
Keep the evidence within reach.
The Evidence tab collects shared schematics, assessment checks, changes, correction plans, verification receipts and runner diagnostics. Each record includes its capture time, environment, run and available source information. Source revisions that were not recorded stay labeled as unknown.
In the local runner, ask “List this project's artifacts, then open the latest assessment.” This indexes existing approved records without running new checks. Ask “Capture runner diagnostics” to save an operational health record, or prepare a correction plan to retain its proposed steps. You can compare two records of the same kind and environment.
Share a report or diagnostic with the website
Use the current runner release with artifact-library support. Create a named Runner credential in MCP connections. Set NULL_EVIDENCE_SHARE=enabled, NULL_MAP_PORTAL_ORIGIN=https://nullventures.co and NULL_MAP_RUNNER_TOKEN in the runner's private environment, then restart its MCP connection. This operator setting permits explicit sharing; it does not upload your library automatically.
Ask the agent to list artifacts, review the selected record, then “Share this artifact with my project workspace.” The share_artifact tool accepts a retained record ID. It cannot choose a different destination or project. Shared map snapshots from a named runner also appear in the library.
Hosted copies expire 24 hours after capture. Repeated sharing does not extend that deadline. The library permits up to 100 records and 20 MB per project within that window. Local history remains on your computer. Old records can be viewed and exported locally; collect a new assessment when fresh evidence is needed.
In hosted MCP, ask “List our shared artifacts,” “Open this assessment,” or “Compare these two runs.” You and your agent see the same authorized records. The browser handles graphical viewing and HTML, JSON or Markdown downloads. Downloaded copies remain under your control after hosted expiry.
Examples and demonstration reports do not become project evidence. Product release notes are separate from changes found in your application. Diagnostics describe the runner; they do not establish application security.
Open the evidence library →Knowledge base
Find your next answer.
10 answers available.
How did PRAE know my site?
A preview administrator may have registered it for you. New customers register their application themselves. PRAE learns its stack from the files and configuration approved for the runner; your email address or an open browser tab does not connect the application.
How do I edit a project?
Open Projects or choose Manage projects beneath the project selector. Select a product, edit its name, website or repository reference, and choose Save changes. Your project ID, evidence and connections stay attached to that product. These references do not connect a provider or change approved assessment scope. For a different product, choose Add project. Your remaining allowance appears on the same screen.
Can I archive or delete a project?
Open Projects, select the product and use Project lifecycle. Owners and assigned administrators can archive it: new hosted work and connections stop, while authorized browser review of unexpired evidence remains available. Choose Reactivate project to resume, then create new credentials or authorize hosted clients again.
Only the owner can delete. Download any reports you need from Evidence first; the project-summary download lists reports but does not contain their contents. Type the permanent project ID to schedule deletion. You have 30 days to choose Show projects → Recently deleted → Restore to archive. Reactivation is a separate step. After that deadline, recovery is unavailable and the scheduled cleanup removes current project details and shared content, keeping a minimal identity record.
Shared evidence still expires 24 hours after capture; the recovery window does not extend it. Existing offline receipts can remain valid until their expiry, up to seven days. Your website, repository and cloud infrastructure are unaffected. Neither archive nor deletion cancels billing or automatically frees a licensed project slot; contact the platform team about replacing a product. Local copies, billing records, security audit history and encrypted backups have separate lifecycles.
Can I work on several projects?
Yes, within your workspace's project allowance. Select the project before creating a credential, downloading a receipt or opening evidence. Owners and administrators add products under Projects. Each runner is fixed to its approved project and evidence workspace; switching the website selector does not retarget an existing local runner.
Why does access say “Not active”?
An account and a registered project do not grant assessment access. You need a current assigned preview or paid team/project entitlement. Paid sales are currently closed. Ask your workspace owner to check your invitation and project assignment, or use the product contact form for pilot access.
Why does my schematic say “Awaiting evidence”?
No snapshot has been shared for the selected project. Local diagrams are private to the runner by default. Use the sharing instructions above if you want them in the website. Hosted MCP can only review existing shared evidence. Registering a project or creating an agent credential does not run an assessment.
Which credential do I need?
Use a Runner credential to share approved evidence from the collecting runner. Use an Agent credential to read shared evidence through a client that needs a manual key. Where supported, browser authorization gives the hosted client its own token. Each connection is person- and project-bound. Store credentials in secret settings; never share an account key with teammates.
My connection or license expired. What next?
Sign in and check your project access. Manual credentials and offline receipts expire within seven days. Revoke an expired or unused connection and create a replacement if eligible. Download a new license receipt and use the installed runner's license refresh --file /absolute/path/new-receipt.json command. Retained reports and backups remain readable after expiry.
Does a healthy connection mean my application is secure?
No. Connection health describes access or the evidence store. A shared snapshot confirms that evidence was shared. Security conclusions depend on the individual checks, their scope, freshness and verification. Unknown and untested controls stay visible.
Will PRAE automatically fix or deploy changes?
The platform prepares correction and verification guidance. Your coding assistant can implement a reviewed change through its normal tools. Deployment, broader scope and final risk decisions remain with the authorized operator. Runtime interception of an agent's other actions is not part of this preview.