# Orygn LLC Orygn LLC is a software and security company based in the Houston, Texas area. Orygn builds custom software, internal tools, workflow automation, and security-focused systems for small businesses and growing teams. The company also publishes open-source security tools for Microsoft Entra ID, file integrity, and CI/CD supply chain security. Website: https://orygn.tech Phone: (832) 974-0334 (call or text) GitHub: https://github.com/OrygnsCode LinkedIn: https://www.linkedin.com/company/orygn-llc/ Location: Houston, Texas area (serving Cypress, Katy, Tomball, Spring, The Woodlands, and clients nationwide) --- ## Services ### Custom Software Development Orygn builds custom software for businesses whose workflows have outgrown off-the-shelf tools. This includes full-stack applications, data pipelines, API integrations, and operational systems designed around how a business actually works. Orygn works with small businesses, growing teams, and independent operators across the Houston area and nationally. Common projects include: - Internal workflow applications - Data processing and reporting systems - API integrations between existing tools - Migration from spreadsheets or manual processes to purpose-built software URL: https://orygn.tech/services/custom-software ### Internal Tools Orygn builds internal tools such as admin dashboards, client portals, reporting interfaces, onboarding systems, and approval workflows. These are operational surfaces built for internal use rather than public-facing customers. Tools are designed around specific team needs with role-based access, integrations with existing databases and APIs, and deployment to the client's infrastructure. URL: https://orygn.tech/services/internal-tools ### Workflow Automation Orygn automates repetitive business processes including data entry, report generation, file processing, email and notification workflows, system-to-system data transfers, approval routing, and manual handoffs between teams or tools. Automation connects multiple systems: CRMs, databases, email, cloud storage, APIs, and internal tools. URL: https://orygn.tech/services/workflow-automation ### Security Hardening Orygn provides security hardening services including infrastructure review, configuration audits, identity and access tightening, and compliance-aligned controls. This covers cloud environments (Azure, AWS, GCP), Microsoft 365 and Entra ID tenants, CI/CD pipelines, web applications, and network perimeter configurations. URL: https://orygn.tech/services/security-hardening ### Website Design and Development Orygn designs, builds, improves, and migrates websites for small businesses and growing teams in the Houston area. Orygn works across all the major website platforms, including WordPress, Shopify, Wix, Squarespace, Webflow, GoDaddy, Weebly, BigCommerce, Square Online, WooCommerce, Adobe Commerce (Magento), Ghost, and more, and also builds fully custom sites from scratch on modern web standards. Whether a business wants its existing platform site improved in place, migrated to something faster, or a new custom build, Orygn meets it where it is. Every option is mobile-first, fast-loading, and built with SEO fundamentals, with hosting setup, deployment, and ongoing support. URL: https://orygn.tech/services/web-design ### Accessibility and Section 508 Testing Orygn provides manual web accessibility audits and Section 508 conformance testing, performed by a certified DHS Trusted Tester (an individual certification the U.S. Department of Homeland Security awards to people who pass its training and exam in the standardized process federal agencies use to test Section 508 conformance, built on the ICT Testing Baseline for Web). Services include: manual WCAG 2.1 and 2.2 Level AA audits reported per success criterion with severity, user impact, location, screenshots, and developer-ready remediation guidance; Section 508 conformance testing; VPAT authoring delivered as an Accessibility Conformance Report (ACR) using the standard Supports, Partially Supports, and Does Not Support terms that government, university, healthcare, and enterprise procurement teams require; code-level remediation (Orygn is a development firm, so it fixes the issues rather than only reporting them); screen reader and keyboard testing; re-test validation; and ongoing monitoring and training. Orygn does not use, resell, or endorse accessibility overlays or widgets, which cannot reliably fix underlying code and do not stop lawsuits. Testing and remediation cover WordPress, Shopify, Wix, Squarespace, Webflow, and custom sites and web applications. Orygn does not claim to guarantee ADA compliance or provide legal advice; it tests conformance to WCAG and Section 508 and reduces legal risk through documented, good-faith conformance work. Serving private businesses and public-sector, education, and healthcare vendors nationwide, based in the Houston, Texas area. Use case: Businesses facing an ADA demand letter or lawsuit risk, software and service vendors asked by a federal, state, university, or healthcare buyer to provide a VPAT/ACR before purchase, state and local governments meeting WCAG 2.1 AA under the ADA Title II rule, and organizations building or redesigning a site that must be accessible from day one. Keywords: Section 508 tester, DHS Trusted Tester, Section 508 conformance testing, Section 508 compliance, WCAG 2.2 AA audit, WCAG testing, accessibility audit, VPAT services, Accessibility Conformance Report, ACR, accessibility remediation, manual accessibility testing, web accessibility consultant, ADA website accessibility, accessibility overlay alternative, website accessibility Houston Texas. URL: https://orygn.tech/services/accessibility --- ## Products - Hosted Tools and MCP Servers ### OPA MCP OPA MCP is an open-source Model Context Protocol server that gives any MCP-compatible AI client (Claude Desktop, Claude Code, Cursor, VS Code with GitHub Copilot Chat, Windsurf, Zed, and others) a structured interface to Open Policy Agent and the Regal linter. It exposes 50+ tools with schema-validated inputs and a stable error taxonomy so AI agents get structured results rather than raw CLI output to parse. Tool categories: (A) Authoring and static analysis: rego_format, rego_check, rego_check_schema (validates input.* references against a JSON Schema), rego_lint (Regal), rego_parse_ast, rego_inspect, rego_capabilities, rego_deps, rego_migrate_v1. (B) Evaluation and testing: rego_eval, rego_eval_with_explain, rego_eval_with_profile, rego_eval_with_coverage, rego_test, rego_test_multiroot (runs tests across multiple independent package roots without package-conflict errors), rego_bench, rego_compile_query. (C) Bundle operations: opa_bundle_build, opa_bundle_sign, opa_bundle_verify, opa_exec. (D) OPA server management: opa_list_policies, opa_get_policy, opa_put_policy, opa_delete_policy, opa_get_data, opa_put_data, opa_patch_data, opa_delete_data, opa_query_decision, opa_compile_query, opa_health, opa_status, opa_config. (E) Higher-level helpers: rego_explain_decision (walks every rule that fired and every rule that did not), rego_explain_undefined (diagnoses why a fully-qualified Rego query produces no value), rego_verify (formally verifies Rego rule invariants using Z3 SMT solving via WASM, no additional install required), rego_generate_test_skeleton, rego_describe_policy, rego_suggest_fix, rego_coverage_gaps, rego_security_audit, rego_infer_input_schema (statically derives JSON Schema for all input.* fields), rego_fix (runs regal fix for mechanical auto-fixes), rego_format_write (opa fmt --write in-place), rego_policy_diff (evaluates same query against two policies and compares results), rego_playground_share (publishes a policy as a GitHub Gist and returns a shareable link loadable by OPA or Conftest). (F) Conftest: conftest_test, conftest_verify, conftest_pull, conftest_push. (G) Meta: mcp_server_info. MCP resources: opa://builtins (categorized OPA built-in function reference derived live from opa capabilities), opa://style-guide (condensed Rego style guide formatted for LLM consumption), opa://patterns (curated library covering RBAC, ABAC, Kubernetes admission, IaC gates, API authorization, and rate limiting, each with when-to-use, full Rego, a test, and common pitfalls). MCP prompts: policy_authoring_assistant, policy_review_checklist, decision_debugging_workflow. Security design: subprocesses run with shell disabled and hard timeouts (SIGTERM then SIGKILL); file-based tools refuse to read outside OPA_MCP_ALLOWED_PATHS; OPA_TOKEN never echoed in logs or responses; stdout reserved exclusively for the MCP protocol; npm releases published with provenance attestations. Distribution: npm (@orygn/opa-mcp), Docker Hub (orygn/opa-mcp, multi-arch linux/amd64 + linux/arm64 with bundled OPA and Regal), Smithery registry (@orygn/opa-mcp), the official MCP Registry (registry.modelcontextprotocol.io, server name io.github.OrygnsCode/opa-mcp), signed .mcpb bundle in GitHub releases. The OPA binary is bundled with the npm package as platform-specific optional dependencies (Linux x64/arm64, macOS x64/arm64, Windows x64), pinned to OPA 0.69.0, so npx @orygn/opa-mcp runs without a separate OPA install; binary resolution order is OPA_BINARY, then opa on PATH, then the bundled fallback. Drop-in example configs for all major clients in the examples/ directory of the repository. Stack: TypeScript strict, Node.js ≥20, MCP SDK, Vitest (unit + integration tests), CodeQL, npm provenance publishing. CI runs across Ubuntu, macOS, and Windows on Node 20, 22, and 24. Listed in the official OPA Ecosystem at openpolicyagent.org/ecosystem/entry/opa-mcp. MIT licensed. Current version: v0.2.0. Use case: Security engineers, platform engineers, and developers who work with OPA policy-as-code and want to author, test, debug, and deploy Rego policies directly within their AI coding assistant without switching to a terminal or learning OPA CLI argument ordering. npm: https://www.npmjs.com/package/@orygn/opa-mcp Docker: https://hub.docker.com/r/orygn/opa-mcp GitHub: https://github.com/OrygnsCode/opa-mcp-server OPA Ecosystem: https://www.openpolicyagent.org/ecosystem/entry/opa-mcp Product page: https://orygn.tech/products/opa-mcp ### BitSeal BitSeal is a cryptographic provenance system that creates tamper-evident, verifiable proofs for digital files. Files are hashed entirely in the browser using BLAKE3 with 64KB Merkle tree leaves and SHA3-512 as a second whole-file digest. The Merkle root is signed by the BitSeal Authority using Ed25519 (RFC 8032) and the digest is submitted to OpenTimestamps calendar servers for Bitcoin blockchain anchoring. Seals persist in a Neon Postgres ledger. The Authority verification key is published at /.well-known/bitseal-authority.json and derived at runtime from the signing key. A daily Vercel cron upgrades pending OpenTimestamps proofs once Bitcoin blocks confirm. The open-source Python SDK (BitSealCore.py) provides full offline verification: recompute the BLAKE3 Merkle root, verify the Ed25519 signature, and optionally check the Bitcoin anchor. Built with Next.js 16, React 19, Neon Postgres, Cloudflare Turnstile, and Upstash rate limiting. Use case: Proving file integrity and existence at a specific point in time for contracts, legal documents, audit artifacts, software releases, and compliance records. Bitcoin anchor provides independent verification without trusting BitSeal infrastructure. Live application: https://bitseal.orygn.tech Product page: https://orygn.tech/products/bitseal ### File X-Ray File X-Ray is a browser-first metadata inspector for 60+ file format families across 180+ extensions, including images and camera RAW (JPEG, PNG, WebP, TIFF, HEIC, AVIF, GIF, CR2, DNG), documents (PDF, Word, Excel, PowerPoint, OpenDocument, EPUB), video and audio (MP4, MOV, MKV, MP3, FLAC, WAV, M4A, OGG, AIFF), email, archives, apps, fonts, SQLite databases and GPS tracks. Core parsing and metadata stripping run entirely in the browser. Features include GPS coordinate plotting on an interactive Leaflet map, per-field risk classification (high/medium/low), AI-powered summaries via Google Gemini (user-triggered, processed server-side), byte-level PDF forensics, metadata stripping with strip-diff reports, and a field-by-field guide. The landing bundle is code-split, and each format's parser loads only when a file of that type is opened. Built with React 19, TypeScript, Vite, Tailwind 4, and Upstash rate limiting on server-side endpoints. Use case: Privacy-conscious individuals and businesses inspecting files for sensitive metadata (GPS, author, device fingerprints, edit history) before sharing, and stripping that metadata with a verifiable diff report. Live application: https://filexray.orygn.tech Product page: https://orygn.tech/products/file-xray ### WebShield WebShield is a production security scanner that checks any URL across transport, network, and application layers using a custom Node.js scanning engine. It opens raw TLS sockets to inspect cipher suites, ALPN, forward secrecy, and certificate chains. It resolves DNS (CAA, MX, DNSSEC) and probes email authentication (SPF, DMARC, DKIM across 13 common selectors, MTA-STS, TLS-RPT, BIMI). It parses CSP directives, checks CORS, SRI, reverse tabnabbing, mixed content, and cookie security. It fingerprints CVEs via OSV.dev, inventories third-party trackers (Google Analytics, Meta Pixel, TikTok, Clarity, and 20+ others), and fingerprints server technology from headers, cookies, and HTML patterns. It probes for exposed paths (.git/config, .env, phpinfo, server-status) with content validation to avoid false positives. Scan results persist in Supabase with shareable report URLs. Includes a 27-article knowledge base with in-depth vulnerability explanations and a remediation engine generating copy-paste configs for Nginx, Apache, Vercel, Netlify, Cloudflare Workers, AWS CloudFront, IIS, Express, Go, and PHP. Built with Next.js 16, TypeScript, Supabase (PostgreSQL), and Cloudflare Turnstile. Use case: Website owners, developers, and security teams running security audits covering headers, TLS, CVEs, DNS, email auth, exposed paths, trackers, and tech fingerprinting in a single scan with actionable remediation. Live application: https://webshield.orygn.tech Product page: https://orygn.tech/products/webshield ### Vendor Access Vault Vendor Access Vault is a production vendor access management application built around three primitives: encrypted credential storage, just-in-time access requests, and an append-only audit log. Encryption: Every credential is encrypted with AES-256-GCM using a fresh 12-byte initialization vector per credential. The ciphertext, IV, and 16-byte authentication tag are stored in separate columns. The encrypted columns are explicitly excluded from list queries so plaintext never leaves the database during normal browsing. Reveals decrypt server-side and only when an authorized non-expired access request exists. Just-in-time access: Viewers cannot see plaintext until they submit an access request with a justification and a duration. Admins approve, deny, or shorten the window. Approved access auto-expires when the window closes. A daily cron also expires pending requests older than seven days. Every reveal writes a credential.viewed audit entry with actor, IP, and user agent. Denied reveals write credential.reveal_denied with the reason. Audit log: Append-only with actor, IP, user agent, and timestamp. Captures vendor edits, credential CRUD, access requests, approvals, denials, reveals, denied reveals, rotations, member changes, and auth events (login, logout, 2FA enable, password reset). The full log is filterable, searchable, and streams to CSV via a dedicated export endpoint. Other capabilities: Vendor directory with owner, criticality, compliance flags, data access classification, and renewal date. Rotation tracking per credential, with a daily cron that emails owners and admins when rotation is within 14 days. When a credential is marked rotated, all active access for it is revoked atomically in the same transaction and each requester is notified. Three-role RBAC (owner / admin / viewer) with last-owner protection. Multi-tenant org isolation with path-scoped routing at /app/[orgSlug]/... and ORM-level orgId filtering on every query. TOTP-based 2FA via Auth.js v5. Google OAuth alongside email and password. Cloudflare Turnstile on signup, login, password reset, and verification resend. In-app notifications inbox with unread badge. Vendor comment threads. Cmd+K commander palette. Help overlay on ? key. Rotation Center with mark-rotated, snooze, and disable actions. Stack: Next.js 16 (App Router, Server Actions, Turbopack), TypeScript strict, Neon Postgres with Drizzle ORM, Auth.js v5, Node crypto AES-256-GCM, Resend with React Email, Cloudflare Turnstile, Tailwind v4 with Shadcn UI, Framer Motion, hosted on Vercel. Tested with 101 Playwright E2E tests across 18 spec files. Cron jobs defined in vercel.json (expire-requests at 03:00 UTC daily, rotation-scan at 03:05 UTC daily) with CRON_SECRET bearer auth. Use case: Teams that need to give vendors and contractors access to internal credentials and SaaS accounts without sharing API keys in Slack, accumulating stale permissions, or losing the audit trail. Common in IT, operations, security, and compliance functions. Free tool: A one-time secret tool at https://vendorvault.orygn.tech/tools/one-time-secret, free with no signup. Paste a password, API key, or note; it is encrypted in the browser with AES-256-GCM and turned into a link that reveals the secret exactly once, then self-destructs. The decryption key travels only in the link's URL fragment and never reaches the server, so only ciphertext the server cannot read is ever stored. The read is atomic, so a second open returns nothing. Unopened links auto-expire after a chosen window, and an optional passphrase adds a second factor. It is a hand-off tool for a single secret, not credential storage; ongoing vendor credentials with approvals and an audit trail are what the vault itself is for. Live application: https://vendorvault.orygn.tech Product page: https://orygn.tech/products/vendor-vault ### DiligenceDesk DiligenceDesk is a federal contractor due diligence tool that reconciles 8 public U.S. data sources into a single deterministic verdict. Sources: SAM.gov (identity, registration, exclusions, NAICS/PSC), DOL Wage and Hour (labor enforcement, willful/repeat violator flags), OSHA (safety inspections and citations), ITA Consolidated Screening List (sanctions, denied persons, entity list), USAspending (federal contract and grant award history), SEC EDGAR (public-company filings), GLEIF (Legal Entity Identifier and Level-2 ownership chains), and NIST NVD (CVE/CVSS exposure mapped via CPE). A local Section 889 prohibited-hardware registry checks for banned telecommunications equipment. The deterministic verdict engine evaluates all evidence against a four-rung ladder: PASS (no automated red flags), WARNING (human review required), FAIL (stop and consult counsel), or NEUTRAL (no federal records found). A sector-risk overlay maps NAICS and PSC codes against 32 NAICS and 44 PSC sensitivity classifications covering defense, nuclear, aerospace, and ammunition manufacturing. Additional capabilities: Batch CSV Auditor for multi-entity screening with combined PDF/CSV export. Interactive risk graph built with @xyflow/react and dagre layout visualizing how evidence connects to the final verdict. Local-first audit history persisted in IndexedDB with no account required. An 18-page reference knowledge base covering FAR 9.104 responsibility standards, SPRS scores, SBA certifications, Davis-Bacon wage determinations, and more. Published methodology page explaining verdict logic. Stack: Next.js 16, React 19, TypeScript strict, Tailwind 4, Upstash Redis (tiered TTL caching), Cloudflare Turnstile, @xyflow/react, jsPDF, Playwright + Vitest. Use case: Government agencies, prime contractors, and compliance teams performing due diligence on potential subcontractors, vendors, and business partners against federal exclusion, sanctions, and performance databases. Live application: https://diligencedesk.orygn.tech Product page: https://orygn.tech/products/diligencedesk ### Beaconly Beaconly is a free AI discoverability audit tool. It checks whether a website is properly configured for AI crawler discovery and citation by auditing three layers: crawler access (robots.txt permissions for GPTBot, ClaudeBot, PerplexityBot, Google-Extended, and others; llms.txt structure and sitemap presence), structured data (JSON-LD Organization identity, sameAs links, dateModified, FAQPage schema, SpeakableSpecification, and knowsAbout), and page structure (meta description, canonical URL, Open Graph tags, heading structure, HTTPS, and response speed). Each check returns a specific pass or fail with an actionable fix. No account or signup required. Use case: Website owners, developers, and SEO practitioners who want to understand and improve their site's visibility to AI systems like ChatGPT, Perplexity, Claude, and Google AI Overviews. Live application: https://beaconly.orygn.tech Product page: https://orygn.tech/products/beaconly ### Omnicord Discord server management MCP for AI agents. Omnicord is a source-available Model Context Protocol server that gives an AI assistant full operational control of a Discord server through your own bot. It exposes 150+ tools spanning chat, moderation, administration, and building an entire community server from a one-paragraph brief. There is no LLM inside Omnicord and no cloud service behind it: the AI is the user's own MCP client (Claude Desktop, Claude Code, Cursor, Windsurf, or any other), and the bot token stays in a local file. Capability areas: server building (plan and execute a full server build from a brief covering roles, categories, channels, and permissions in one additive operation; save, diff, and rebuild layouts as blueprints), messaging (send, edit, pin, react, polls, scheduled messages, message forwarding between channels, DMs, webhooks), reading (channel history, native server-wide message search that matches whole words across channels and inside embeds and polls, members, roles, permissions, audit log), moderation (timeouts, kicks, bans, bulk actions, prune, all preview-first, plus raid lockdown that pauses new invites and DMs between non-friend members for up to 24 hours), AutoMod (Discord server-side filters including maintained slur and profanity preset lists, spam and mention-flood limits, and member profile checks that flag banned words in usernames, nicknames, and bios), real time (subscribe to live server events), structure (channels, categories, permission overwrites, reordering, cloning, voice channel status), community (events with daily, weekly, biweekly, or monthly recurrence, stages, threads, forums, invites, welcome screen, onboarding), expression (emojis, stickers, soundboard sounds), and diagnostics (setup check, bot info, rate-limit status, permission explainers). Safety model: destructive operations (delete, ban, kick, timeout, bulk actions, prune) never execute on the first call. The tool returns a human-readable preview and a single-use confirmation token bound to that exact action; the token expires after two minutes and repeating the call with it executes the action. This is enforced by Omnicord itself, not by the model's judgment, so a confused or compromised AI session cannot skip the gate (controlled by OMNICORD_SAFE_MODE, default on). Moderation additionally preflights Discord's role hierarchy, owner protection, and self protection before the gate. A security self-audit mapped to the OWASP MCP Top 10 is documented in the repository. Transports and self-hosting: stdio (the default, for desktop MCP clients) and Streamable HTTP (for remote-capable clients and self-hosting). The HTTP transport uses bearer auth compared in constant time, rejects browser origins unless allowlisted, validates the Host header to close DNS rebinding, and refuses to bind beyond localhost without OMNICORD_HTTP_TOKEN. The Docker image runs as a non-root user. Setup: one command, npx @orygn/omnicord init, launches a wizard that validates the bot token live against Discord, checks privileged intents, generates an invite link at a chosen permission level, and writes the config into the user's AI client. Claude Desktop, Claude Code, Cursor, and Windsurf are auto-detected. ChatGPT is supported only through the self-hosted remote HTTP transport. Stack: TypeScript strict on Node.js 20+, the @discordjs REST and gateway libraries, the MCP SDK, and Zod. CI runs build, unit, and protocol smoke tests on Linux, macOS, and Windows across Node 20, 22, and 24. License: source-available under the Elastic License 2.0 (licensor Orygn LLC). Free to read, use, modify, and self-host, including for commercial communities; the only restriction is reselling it as a hosted service. Not OSI open source. Distribution: npm (@orygn/omnicord), Docker Hub (orygn/omnicord), the official MCP Registry (server name io.github.OrygnsCode/omnicord), Smithery, Glama (A grade), and PulseMCP. Setup walkthrough video on YouTube. Use case: Discord server owners, admins, and technical community managers who use an MCP-capable AI client and want to build, administer, and moderate a server by describing what they want, with a human-confirmation safety net on every destructive action. npm: https://www.npmjs.com/package/@orygn/omnicord Docker: https://hub.docker.com/r/orygn/omnicord GitHub: https://github.com/OrygnsCode/Omnicord Product page: https://orygn.tech/products/omnicord ### Deposit Record Deposit Record is a free, statute-cited web tool that helps small landlords return a security deposit correctly, state by state. Enter the vacate date and the deductions, and it computes the state return deadline, explains what can and cannot be deducted with verbatim statute quotes, citations, and last-verified dates on every rule, and generates an editable, itemized return letter with citations in the browser. General information, not legal advice. Live states: Texas (Property Code chapter 92, 30-day return deadline), California (Civil Code section 1950.5, 21-day return deadline, with the receipts-and-photos documentation requirements and the AB 2801 and AB 414 amendments reflected), Florida (Florida Statutes section 83.49, which branches: a 15-day full return when the landlord keeps nothing, or a statutory Notice of Intention to Impose a Claim within 30 days after the tenancy ends when any amount is kept, with the balance remitted after the notice; the tool generates both documents in sequence, and its Florida rules reflect section 83.49 as rewritten effective July 1, 2025), and New York (General Obligations Law section 7-108: a 14-day deadline that runs from the day the tenant vacates and covers both the itemized statement and the return of the balance; there is no forwarding-address rule, so the clock runs whether or not the landlord knows the tenant's new address; on the face of the statute, missing the deadline forfeits the right to retain any portion of the deposit; the deposit is the tenant's money held in trust, and commingling it is an independent basis for forfeiting the whole deposit regardless of 14-day compliance; deductions are a closed statutory list; rent-stabilized apartments have their own deposit statute, General Obligations Law section 7-107, effective November 15, 2025 under Chapter 436, which the tool covers with a dedicated guide; rent-controlled units are a different system, and the tool declines to answer for them rather than guess), and Colorado (C.R.S. sections 38-12-101 to 106 as rewritten by House Bill 25-1249, effective January 1, 2026, which many landlord guides still show under the old rules: a 30-day return deadline by default that a lease may extend to as much as 60, counted from the later of the lease ending or the landlord accepting the unit back; a deposit cap of two months' rent, or one month for a mobile home in a mobile-home park, which must also be held in a separate trust account; an exclusive four-category deduction list with nothing allowed for normal wear and tear, which the statute now defines; new 2026 duties including an optional move-out walk-through, a 14-day duty to hand over documentation on request, and limits on carpet and paint deductions; and treble damages plus attorney fees for a wrongful withholding). More states on the way; each state ships only after its rules are verified against the primary statute. Each live state has a return-letter guide; Texas, California, Florida, and Colorado also have normal wear-and-tear guides; Florida adds a guide on the notice of intention to impose a claim, New York adds a guide on rent-stabilized deposits, and Colorado adds a guide on deposit limits. City deposit interest: San Francisco, Los Angeles, Berkeley, and the City of Boulder require interest on deposits covered by their local ordinances. Deposit Record computes it from each city's published rates, the California cities' rent-board rate tables and Boulder's municipal interest formula under B.R.C. chapter 12-2, verified against the cities' own published figures. Accuracy discipline: every rule traces to the primary statute and carries its citation and a last-verified date; rules were checked against the statute text by independent adversarial review; rendered legal text is pinned byte for byte by snapshot tests so it cannot drift silently; where a legal duty is verified but a current figure is not, the tool states the duty and shows a blank rather than guessing a number. Sources behind the rules are monitored for changes and re-verified on a schedule. Privacy: everything runs client-side in the browser. Nothing the user types is transmitted, stored, or sold. No accounts, no ads, no paid tier. Stack: Astro static output, TypeScript, vanilla JS islands, Cloudflare Pages. Use case: small landlords in Texas, California, Florida, New York, and Colorado returning a tenant's security deposit who want the deadline, the deduction rules, and a finished itemized letter grounded in the actual statute rather than forum advice. Live application: https://deposit.orygn.tech Texas: https://deposit.orygn.tech/texas California: https://deposit.orygn.tech/california Florida: https://deposit.orygn.tech/florida New York: https://deposit.orygn.tech/new-york Colorado: https://deposit.orygn.tech/colorado Product page: https://orygn.tech/products/deposit-record --- ## Products - Open Source CLI Tools ### CI Evidence Pack CI Evidence Pack is a command-line tool that generates tamper-evident evidence packages from CI/CD pipelines. It captures build metadata, artifact hashes, commit information, runner details, and timestamps into a signed evidence bundle. Works with any CI system that supports shell execution: GitHub Actions, GitLab CI, Jenkins, CircleCI, Azure DevOps. Use case: Supply chain security, build provenance, SLSA compliance, and audit trails for software releases. GitHub: https://github.com/OrygnsCode/ci-evidence-pack Product page: https://orygn.tech/products/ci-evidence-pack ### Entra OAuth Consent Auditor Entra OAuth Consent Auditor is a command-line tool that scans a Microsoft Entra ID tenant for risky OAuth consent grants. It identifies applications with excessive permissions, admin-consented scopes that should be user-scoped, and patterns consistent with OAuth consent phishing attacks. Use case: Security teams auditing OAuth permissions in Microsoft 365 and Azure AD environments. GitHub: https://github.com/OrygnsCode/Entra-OAuth-Consent-Auditor Product page: https://orygn.tech/products/entra-oauth-consent-auditor ### Entra Credential Sentinel Entra Credential Sentinel is a command-line tool that monitors service principal and application credential expiry dates in Microsoft Entra ID. It flags credentials approaching expiration, already expired credentials, and credentials that have not been rotated within policy. Use case: Preventing production outages caused by expired service principal secrets and certificates. GitHub: https://github.com/OrygnsCode/Entra-Credential-Sentinel Product page: https://orygn.tech/products/entra-credential-sentinel ### Zombie Account Hunter Zombie Account Hunter is a command-line tool that identifies inactive accounts in Microsoft Entra ID tenants. It finds former employees, expired guest accounts, dormant service principals, and users who have stopped logging in. Each inactive account holds permissions and often a paid license that can be recovered. Use case: Identity hygiene, license cost recovery, and reducing attack surface by cleaning up unused accounts. GitHub: https://github.com/OrygnsCode/zombie-account-hunter Product page: https://orygn.tech/products/zombie-account-hunter --- ## Research Orygn publishes original research with open data, source code, and DOI-registered results. Current work spans AI-image privacy and forensics, software supply-chain security, and computational number theory. Research index: https://orygn.tech/research ### The Recipe Is the Fingerprint: Creator Deanonymization from Default AI-Image Metadata at Scale A privacy and AI-image forensics study by Daniel Okwor (Orygn LLC). Every mainstream AI image generator (ComfyUI, Automatic1111, Forge) writes the full generation recipe (base model, LoRAs and embeddings, sampler and settings, negative prompt, software build) into the PNG as cleartext by default, without the user's name. The study shows this recipe is a behavioral fingerprint precise enough to name its creator. Across 15.7 million public AI images spanning four datasets and two platforms, and about 92,000 creators on Civitai, a single image identifies its creator 55.8 percent of the time against the full population, and 54 percent even when near-duplicate reposts cannot match, using only the recipe with no account or server context. The signal is behavioral, not a proxy for tool choice: holding the base model fixed, one image still names the individual 69 to 82 percent of the time, and a structural-only fingerprint with no free text reaches 35 percent. Ordinary users who own no custom assets are still identifiable 51 percent of the time, most often through the negative prompt they reuse without thinking (90 percent of distinct negative prompts belong to exactly one creator). On DiffusionDB, drawn from the official Stable Diffusion Discord where a shared bot homogenizes the recipe, the same method reaches only 1.8 percent, so anonymity is a property of how verbose the metadata is, not of whether a username is attached. The full chain from an anonymous image to a named, living account is demonstrated. Only removing all free text, all resource identifiers, and the build string together drives identification below one percent; partial redaction fails. Disclosed to the tool developers and the platform before publication. Author: Daniel Okwor, Orygn LLC (ORCID 0009-0005-2546-181X). Published July 2026. Paper (Zenodo, DOI): https://doi.org/10.5281/zenodo.21500861 Code and reproducibility: https://github.com/OrygnsCode/png-residue Article: https://orygn.tech/research/png-residue ### From Hallucination to Registration: Do the Package Names That LLMs Invent Actually Get Claimed? A software supply-chain security study by Daniel Okwor (Orygn LLC) of slopsquatting, the risk that an attacker registers a package name a large language model invented and waits for a developer or AI coding agent to install it. Most prior work measures how often models hallucinate names; this study measures what happens next, whether the invented names are actually registered and by whom. Using five open-weight code models, 6,800 samples yield 1,641 distinct invented package names confirmed absent from npm and PyPI, and the invented-name space does not saturate: a further 2,000 generations still produce 455 previously unseen names. Re-checked live, every one of the 1,641 is still unregistered. Separately, from public datasets of previously reported hallucinated names, 22 of 149 are registered; adjudicating each by true first-registration date and static content inspection, zero are malicious, with 19 traced to a single anonymous benign-placeholder operation and the other three a name-colliding real tool, a personal reservation, and a 2019 typosquat predating the concept. The install-to-execution primitive (code running at install time, before import) is confirmed in a sealed offline lab using only the authors' own benign package on both npm and PyPI. Conclusion: exposure is large and growing, but claiming is essentially absent, and the hallucinated names that do get claimed are so far benign rather than weaponized. Author: Daniel Okwor, Orygn LLC (ORCID 0009-0005-2546-181X). Published July 2026. Paper (Zenodo, DOI): https://doi.org/10.5281/zenodo.21199427 Code and verification: https://github.com/OrygnsCode/slopsquatting-census Article: https://orygn.tech/research/slopsquatting ### A Computational Study of Base-b Deletable Primes A computational number theory study by Daniel Okwor (Orygn LLC) that counts deletable primes across number bases 3 through 12. A deletable prime is one whose digits can be removed one at a time, never leaving a leading zero, landing on a prime at every step down to a single digit. The study establishes that the counts grow geometrically and that the growth rate splits on parity: every even base grows faster than the adjacent odd base. The split is traced to Euler's totient function: the per-prime offspring count is governed by b squared divided by (totient of b times the natural log of b), and an even base has a totient at most b/2, which raises its growth rate above the parity-blind estimate b/ln(b). A second result gives two rules for which single-digit prime a deletable chain can end on (one modulo 2 in odd bases, one modulo 3 in bases congruent to 1 mod 3), verified against every deletable prime below two million in the applicable bases, with counterexamples showing no analogous rule survives for any modulus 5 or larger. Contributions to the public record: 37 new terms across the ten OEIS count sequences A096236 to A096245, two new OEIS sequences A395332 and A395333, and a full set of source code and verification records. Author: Daniel Okwor, Orygn LLC (ORCID 0009-0005-2546-181X). Published June 2026. Paper (Zenodo, DOI): https://doi.org/10.5281/zenodo.20710618 Code and verification: https://github.com/OrygnsCode/deletable-primes-family Article: https://orygn.tech/research/deletable-primes ## Frequently Asked Questions ### About Orygn Q: What does Orygn do? A: Orygn builds custom software, internal tools, workflow automation, and security-focused systems for small businesses and growing teams. The company also publishes open-source security tools. Q: Where is Orygn located? A: Orygn is based in the Houston, Texas area and works with clients locally and nationwide. Q: What industries does Orygn work with? A: Orygn works across industries including technology, government contracting, professional services, and small businesses of all types. ### About Services Q: How much does custom software cost? A: Cost depends on the scope and complexity of the project. Orygn starts with a conversation to understand the problem, then provides a clear scope and estimate before any work begins. Q: Does Orygn build websites for small businesses? A: Yes. Orygn designs and builds custom websites for small businesses in the Houston area and beyond. These are custom-designed, mobile-first, and built for performance. Q: Does Orygn offer security assessments? A: Yes. Orygn provides security hardening services including infrastructure review, configuration audits, identity and access management, and compliance-aligned controls. ### About Products Q: Are Orygn's tools free? A: The hosted web applications (File X-Ray, WebShield, BitSeal, Vendor Access Vault, DiligenceDesk, Beaconly) are free to use. OPA MCP is open source and MIT licensed, available on npm and Docker Hub. The CLI tools are open source and free under their respective licenses on GitHub. Q: Does File X-Ray upload my files to a server? A: No. Core parsing and metadata stripping run entirely in the browser. Optional AI summaries and reverse geocoding use server-side proxies, but file bytes never leave the device. Q: What is WebShield? A: WebShield is a production security scanner that checks any URL across transport, network, and application layers: security headers, TLS handshakes, CVEs, DNS, email authentication, exposed paths, trackers, and technology fingerprinting. It includes a 27-article knowledge base and remediation engine. Q: What is BitSeal? A: BitSeal is a cryptographic provenance system that seals files with BLAKE3 Merkle trees, Ed25519 Authority signatures, and Bitcoin-anchored timestamps via OpenTimestamps. Seals can be verified offline with standard cryptographic libraries. Q: What is DiligenceDesk? A: DiligenceDesk reconciles 8 federal data sources (SAM.gov, DOL, OSHA, ITA Consolidated Screening List, USAspending, SEC EDGAR, GLEIF, NIST NVD) plus a Section 889 prohibited-hardware registry into a deterministic PASS/WARNING/FAIL/NEUTRAL verdict. It includes batch CSV auditing for multi-entity screening, an interactive risk graph, sector-risk overlay (32 NAICS / 44 PSC codes), local-first audit history, an 18-page reference knowledge base, and PDF/CSV export. Q: What is Vendor Access Vault? A: Vendor Access Vault is a production vendor access management application that vaults credentials with AES-256-GCM encryption (per-credential IV, separate authTag), gates plaintext reveals behind just-in-time access requests with admin approval and auto-expiration, and writes an append-only audit log of every action with actor, IP, and user agent. Includes vendor directory with risk metadata, rotation tracking with cron emails and atomic access revocation, RBAC (owner / admin / viewer) with multi-tenant org isolation, TOTP 2FA, Google OAuth, Cloudflare Turnstile bot protection, and CSV audit export. Q: What is Beaconly? A: Beaconly is a free AI discoverability audit tool running 35 checks across robots.txt, llms.txt, JSON-LD structured data, and page structure to determine whether AI systems like ChatGPT, Perplexity, and Claude can find and cite a site. Q: What is Deposit Record? A: Deposit Record is a free, statute-cited web tool at https://deposit.orygn.tech that helps small landlords return a security deposit correctly. It computes the state return deadline from the vacate date, explains deduction rules with verbatim statute quotes, citations, and last-verified dates, computes city deposit interest for San Francisco, Los Angeles, Berkeley, and the City of Boulder, and generates an editable itemized return letter in the browser. Texas, California, Florida, New York, and Colorado are live. Everything runs client-side and nothing the user types leaves their device. It provides general information, not legal advice; Orygn is not a law firm. ### About Research Q: Does Orygn publish research? A: Yes. Orygn publishes original research with open data, source code, and DOI-registered results at https://orygn.tech/research. Current work spans AI-image privacy (a large-scale study showing that default AI-image metadata deanonymizes its creator), software supply-chain security (a registration census of LLM package hallucinations, or slopsquatting), and computational number theory (deletable primes and related OEIS sequences).