Palantir Startup Fellowship — Cohort 003 · Application Brief

ARGUS(working name)

Agentic supply-chain risk scanning, modeled as a live Foundry Ontology.

Repo Dep Owner Find Action
Sardor Razikov Tashkent, Uzbekistan Solo, full-time Pre-seed · $0 raised Not yet incorporated
Status
CVE/advisory matching — live OSV.dev, 5 manifest ecosystemsBuilt + tested
Agent loop (plan → tool → observe → answer)Built + tested
Tamper-evident audit log (SHA-256 chain + Ed25519)Built + tested
Fleet-scale cross-repo orchestratorBuilt + tested
Foundry write adapter (local-mirror fallback)Built + tested
Foundry Ontology — live tenant instantiationDesigned, not live
70/70 tests passing validated on 3 real public repos blocked only on AIP Developer Tier signup
The problem

A security or engineering lead with more than a handful of repos gets supply-chain risk visibility from disconnected per-repo scans, or nothing at all. “This CVE shows up in 12 repos owned by 4 teams” is a manual cross-check today. Modeled as linked Ontology objects instead of flat scan output, it becomes a link-traversal query.

Field note
The false positive it caught

First live pass on pallets/flask reported 27 findings — implausible for a well-maintained project. Root cause: examples/celery/requirements.txt, a 2023 demo pin, was scanned as Flask’s own dependency surface. Fixed with path-based classification, applied at both the single-repo and fleet-report layers.

27findings, first pass
0production findings, post-fix
17NodeGoat — correctly still flagged
Foundry / AIP fit
Ontology
Repository, Dependency, Finding, Action as linked object types — turns “does repo X have CVE Y” into “which CVEs are shared fleet-wide, and who owns the fix.”
AIP Logic
Native home for the existing plan → tool → observe → answer agent loop, and for the write-back action layer (propose a fix, gate on approval, execute).
Pipelines
Ingest repo manifests/lockfiles and OSV.dev results into the Ontology on a schedule, so risk state is always current, not scanned-on-demand.
Evals
Precision/recall harness a design partner would need before trusting automated write-back actions.
Architecture
manifest_parsers.pydependency parsing, 5 ecosystems, lockfile-preferred
cve_matcher.pyOSV.dev batch query + cross-source dedup
multi_repo.pyfleet orchestrator — clone N repos, cross-repo CVE sharing
foundry_client.pyOntology write adapter — live OSDK calls or local mirror
agent_loop.pyplan → tool → observe → answer, from RepoMind
audit.pytamper-evident audit log
ontology/schema.jsonRepository / Dependency / Finding / Owner / Action
Founder