The proof layer for simulation

Whether your simulation scenarios would fail if the system under test got worse. It injects faults from a catalogue - a blinded sensor, a lagging picture, a weak grip - and watches whether each scenario's own pass/fail checks object. A scenario that no fault can fail costs compute on every merge and is evidence of nothing.

One script that runs a scenario and honours an exit code: 0 if it passed, 1 if it failed, 3 if the fault means nothing in that scenario, anything else if the harness broke. The fault arrives as JSON in an environment variable. It has been run through reference adapters for CARLA, Isaac Lab and Meta-World on MuJoCo, written this way.

Sweeps run where your simulator is, and scenario source never leaves it: the collector refuses it by name, along with your adapter's command line, its environment and any path. What --post sends is a summary - scenario names, scores, which faults were caught - and, if you ask, the recording with everything your adapter printed stripped out.

A hosted worklist needs more than a summary, and gets it only when you say so: mutational project push sends the fault catalogue, what each scenario asserts and the format a model may write in, and says what it is sending every time it runs.

In the browser, nothing leaves the tab. The worker that reads your files deletes its own network access before it accepts one, and this site's account API refuses any request larger than four kilobytes - there is nowhere here to send a file.

1,000 sweeps posted a month, 10 GB at rest - recordings, full records, pictures and project documents together - 10 API tokens, 365 days of history; 20 projects with 5 workers each, 300 campaigns, 500 proposed scenarios and 100 renders a month. Browser use is not metered. A sweep refused for a limit is still on the machine that ran it, and can be posted later from its recording.

Sign in with your email and download it from your dashboard: one static binary for macOS or Linux, on Apple silicon, Intel or Arm, with its checksum. There is an install one-liner for CI.

Yes. mutational mcp serves everything over the Model Context Protocol beside your simulator, and the collector serves the same tools over HTTP for an agent that is somewhere else. The rule both enforce is the product: a model may propose anything, and only a sweep accepts it. Give an agent an agent token and it can add to your history, ask for proposals and queue campaigns - and cannot delete, weaken, approve its own proposals, or spend your render credits.

You do, directly, on keys you bring: OpenRouter for proposing scenarios, World Labs for renders, and optionally TypeSafe for filing field notes. A key is kept sealed - we can use it and cannot show it, to you either - and is sent only to the provider it belongs to. Every call made with one is listed in your dashboard with its host, its purpose and what kind of thing was sent. Set a spending cap at the provider: it is theirs to enforce. A set of five proposed scenarios has cost about four to eighteen cents; a draft render about eighteen.

Delete any sweep through the API and its recording goes with it. Delete your account from the dashboard and the whole workspace goes: recordings first, then every row.