Knurlsoft

Software you can check, not just trust.

Knurlsoft builds small, security-critical components and ships the evidence with them — fuzz harnesses, mutation scores, and proofs where they earn their keep. Today that means Entra ID modules for Ignition SCADA; next, Amoxtli, a crash-durable runtime for AI agents.

What ships

One shipping today. One in development.

Each module does one job completely, and modules in a family share a core and a buyer — so the second is always easier to say yes to than the first.

Available now

Ignition modules

Entra-native security and integration modules for Ignition SCADA gateways. Datasource Auth — Entra ID (formerly Azure AD) authentication for Azure SQL — is shipping today. Further modules are built on request; the first customer sets the order.

In development · v0

Amoxtli

The agent runtime that never loses a page. A personal AI agent runtime — crash-durable sessions committed to git, branchable work, persistent memory, container-isolated execution, and routing that learns which model earns each task.

Building something in a serious industrial or developer niche that nobody is serving well? Say what you need →

How it is built

Small interface. Deep implementation. No loose ends.

The same principles run through every Knurlsoft module — the buyer is a security-conscious engineer, and so is the person writing it.

Start a conversation

Secret-first

Credentials and tokens are handled as architectural guarantees, not settings — no access token on disk, nothing secret in a log, and validation errors that carry the field and the reason but never the value.

Tested the way attackers test

Code is fuzzed, mutation-tested, and machine-checked where that is warranted. CVE-2026-42189, a pre-authentication denial of service in the SSH library behind Warpgate, came out of a harness built exactly this way. The same harness runs against Knurlsoft's own code.

One engineer, ten years on a plant floor

The person who answers support email wrote the module, and before that spent a decade building and running a 200-engineer SQL Server, MES and Ignition estate. Email goes to him, not to a queue.

Nothing to unwind

Licenses are perpetual and no module phones home. Remove one and your datasources fall back to standard driver configuration in minutes — which is also the honest answer to what happens if a one-engineer vendor ever stops shipping.

Let's talk about your stack.

Whether it is Ignition today or the niche worth building next — start the conversation.