Open-source runtime verification for AI, licensed under Apache-2.0.
QWED
Contact

Type to search pages, engines and advisories.

    Looking for API details?Search the docs

    What QWED does not verify

    A check is only useful if you know where it stops. This page sets out what QWED does not verify, what its results depend on, and the limits each package states for itself. A claim outside these lines comes back UNVERIFIABLE, and is denied by default.

    Intent

    QWED verifies the formal statement it is given or extracts, not whether that statement is what someone meant. A correct sum of the wrong numbers is still a correct sum. Deciding that the right question was asked stays with the people and systems around QWED.

    The translation step

    Some checks start from natural language. For those (/verify/natural_language and /verify/logic), QWED asks the model you configure to turn the text into a formal statement. That translation is not itself verified.

    • The formal statement is part of every result, so a person or a policy can check that it says what was meant.
    • The prompt goes to the provider you configure. With a model you run yourself, for example through Ollama, nothing leaves your infrastructure.
    • Optional PII masking (qwed[pii]) redacts card numbers, social security numbers and email addresses before the model call.

    Coverage

    QWED does not cover every kind of claim. A claim that no engine supports comes back UNVERIFIABLE, never VERIFIED. Within the engines, three limits matter most:

    • Advisory engines do not decide. Fact, Graph, Image, Reasoning and Consensus produce signals for review. Heuristic and model-based results are never reported as VERIFIED; Graph, Image and Consensus can return it only on a deterministic sub-path that carries a proof.
    • Symbolic searches, it does not prove. It looks for counterexamples with CrossHair and returns UNVERIFIABLE or BLOCKED.
    • Running code is not verifying it. The Stats engine executes statistical code in a sandbox and returns UNVERIFIABLE.

    What each engine may claim

    Soundness

    A result is only as sound as the tools behind it: SymPy, Z3, SQLGlot, CrossHair and QWED’s own rule sets. When one of them gets it wrong, so can QWED. Every such case found so far is published as a security advisory with the version that fixes it.

    6advisories where a check returned VERIFIED for a false claim5advisories where a guard let through something it should have stopped

    The proof engines are also tested at every release on claims with a known answer. The latest results · The full track record

    Enforcement

    QWED returns a result and an admission decision. It does not stop anything by itself. Your integration acts on DENY, or a QWED product does it for you: QWED Security, for example, fails the pull request check. If an integration ignores the decision, QWED cannot prevent the action.

    What a signature proves

    QWED products that sign their results sign them with their own key. The Verification Context specification is explicit about what that does and does not establish:

    • It shows that the signed bytes came from the holder of that key, and were not changed afterwards.
    • It does not establish independent trust, validate the formal statement, make a proof stronger or imply admission.
    • An independent witness for signatures, the root of trust, is an open question for a future version of the specification.

    Package by package

    Each package states its own limits in its README. They are repeated here, with the development status the package declares on PyPI.

    • QWED Finance

      Beta
      • QWED Finance checks figures and messages. It is not a trading platform, a market data feed or a replacement for your risk models.
      • Checks for MiFID II and Basel III are still in progress.

    • QWED Legal

      Beta
      • QWED Legal is not a legal reasoning engine and not a replacement for lawyers. Interpretive legal reasoning is never trusted automatically.
      • Clause, citation and fairness checks are signals for review, not proofs. The fairness check uses a model you supply.

    • QWED Tax

      Status not declared
      • QWED Tax is not a calculator, a filing platform or a payroll system. It checks decisions that an AI or another system has made.
      • It covers specific rules for the United States and India, not every tax regime. It does not file returns.

    • QWED Infra

      Status not declared
      • QWED Infra currently focuses on AWS and Terraform. Kubernetes and Azure are on the roadmap.
      • NetworkGuard does not model NAT gateways, VPC peering, network ACLs or Transit Gateway. When they are present it returns UNVERIFIABLE instead of guessing.

    • Open Responses

      Beta
      • Tool blocking is a configurable blocklist, not a sandbox, and pattern scanning is a heuristic.
      • Personal data produces warnings, not blocks.
      • Results are not cryptographically attested.
      • Warn-only streaming mode turns the trust boundary off.

    • MCP server

      Beta
      • The tool runs with the server’s privileges. Connect only clients and inputs you trust.
      • Running code does not by itself detect injection.
      • The earlier verify_* tools were removed in v0.2.1.

    • QWED A2A

      Alpha
      • Only finance checks can return verified. Logic and code checks return heuristic_pass, which is not admissible on its own; never execute such a payload without your own sandbox.
      • General and data-query messages are unverifiable.
      • It needs a signing key in QWED_A2A_SIGNING_KEY_PEM.

    • QWED UCP

      Alpha
      • It is not a cart, a payment processor or a fraud system.
      • verify_totals_only() checks totals alone and should not be treated as a final verdict.
      • Replay protection is kept in memory only.

    Versions and support

    Sources: What QWED does not do in the qwed-verification README, the Verification Context specification, and each package’s README.