Móðguðr
The nordisk supply-chain gatekeeper: a leaf Rust crate that hands any artifact a CVE / license / provenance verdict (Pass / Warn / Block) — and, with its heavy SCIP engine, diffs the behaviour of your entire dependency world between two snapshots over a time-travelling Iceberg warehouse.
Móðguðr guards Gjallarbrú, the bridge to Hel — she challenges everyone who tries to cross and demands to know who they are.
Mashup — the verdict, plus what changed
A scanner hands you today's verdict; modgunn also remembers every advisory and world-snapshot and tells you what changed — categories the scanners have no concept for (vs Trivy · Snyk · Dependency-Track):
| capability | modgunn | Trivy | Snyk | Dependency-Track |
|---|---|---|---|---|
| Reachability-gated vulns — is the CVE actually called? (SCIP call-graph) | ✅ | ✗ | ✅ | ✗ |
| Whole-world behaviour-delta between snapshots — capability drift, blast-radius, tripwires | ✅ | NA | NA | NA |
| Advisories + world-snapshots in a time-travel + CDC Iceberg warehouse | ✅ | NA | NA | NA |
Embeddable leaf crate — drop the gate (core::Verdict) inside another Rust app | ✅ | ◐ | ✗ | ✗ |
The full matrix — every capability, all rivals — is in the overview. Rows marked NA: the rival has no such category, not a missing feature.
Measured — the verdict hot path
The numbers below are generated from the warehouse bench_runs table by
nornir docs render modgunn; they come from nornir bench run modgunn
(bench/examples/nornir-bench.rs) over a deterministic synthetic advisory world.
fleet_scan is the shipped Engine A (linear match) fleet path, fleet_scan_indexed
the Engine B (inverted-index) one over the same fixture — and the harness asserts
both find exactly the same findings, so the speedup is honest.
v0.0.5 · oden · 32 cores · 2026-07-22
| workload | advisories | blocked | cores | elapsed_ms | index_buckets | index_build_ms | n | ns_per_verdict | packages | telem_cores_busy_avg | telem_cores_busy_max | telem_cpu_pct_avg | telem_cpu_pct_max | telem_elapsed_ms | telem_mem_pct_max | telem_mem_peak_mb | telem_n_cores | total_findings | verdicts_per_sec |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| modgunn.fleet_scan | 4000 | 32 | 35 | 20000 | 1757 | 600 | 28 | 28 | 59.71 | 59.71 | 122.82 | 5.75 | 21.23 | 32 | 30846 | 0.569M | |||
| modgunn.fleet_scan_indexed | 4000 | 32 | 7 | 1952 | 0.75 | 20000 | 334 | 600 | 4 | 4 | 14.21 | 14.21 | 889.15 | 5.73 | 27.04 | 32 | 30846 | 2.995M | |
| modgunn.verdict_assemble | 4000 | 8645 | 4 | 20000 | 184 | 600 | 2 | 2 | 8.20 | 8.20 | 719.56 | 5.62 | 27.04 | 32 | 30846 | 5.438M |
Read the real docs
- 📖 The complete manual —
docs/manual.pdf— every subsystem chapter (both engines, the warehouse seam, exploit-intel gating, the behaviour-delta analyses). - 📄 Full overview —
.nornir/README-full.md— the detailed pitch, the full competitive matrix, what each engine does, and the quickstart. - 📝
docs/book.md— the manual, as Markdown. Search it withnornir docs search modgunn "<query>".