Risk OS Red Try Stoa

Example: a multi-agent app

Meridian is a demonstration multi-agent backend for a neobank — eight specialist agents behind one supervisor, across eight frameworks and two languages. It is Stoa's reference application: every risk is planted on purpose, and one agent (compliance) is deliberately well-controlled so a scan shows contrast, not just red. The full source is in examples/meridian-ops.

Supervisororchestrator LangGraph · routes by intent
paymentsLangChain
fraudCrewAI
complianceLangGraph
devopsAgno
researchOpenAI Agents SDK
marketingAutoGen
supportVercel AI SDK
triagePydanticAI
payments · LangChain
fraud · CrewAI
compliance · LangGraph
devops · Agno
research · OpenAI Agents SDK
marketing · AutoGen
support · Vercel AI SDK
triage · PydanticAI
ElevatedModerate ControlledBaseline

The agent mesh

Each agent owns a slice of the bank's operations. Control status below is from a real Stoa scan of the codebase.

AgentFrameworkHandles ReachesControl status
paymentsLangChainRefunds & payoutsStripe · PostgresElevated
fraudCrewAIRAG case triagePinecone · SIEMElevated
complianceLangGraphRegulatory filingsAudit log · HITLControlled
devopsAgnoInfra operationsShell · AWSElevated
researchOpenAI Agents SDKMarket researchTavily · HF modelsModerate
marketingAutoGenCampaign sendSendGridModerate
supportVercel AI SDKFirst-line chatZendesk · SlackModerate
triagePydanticAIIntent routingBaseline

What a scan reports

Stoa inventories the agents, maps capabilities and integrations, and scores each across eight risk dimensions — five assessed directly, three proxy signals flagged for runtime follow-up.

Scope violationstrongData exfiltrationstrongUnauthorized actionstrongOutput integritypartialAdversarial manipulationpartialBehavioral instabilityproxyModel driftproxyOperational controlpartial
Run it yourself: stoa scan examples/meridian-ops, or open the live scan report. The comprehensive run-e2e.sh driver asserts 53 checks across the whole tool surface.