A new project, built in the open
MessageFoundry started in May 2026. It is Early Access, beta-level software under fast development toward 1.0.
Early Access means changes and rough edges
The engine installs, runs, and moves messages. It does not yet have a long production track record or a staffed support organization.
- Expect bugs and rough edges during Early Access.
- Releases arrive often, and behavior can change before 1.0. Pin a version and read release notes before upgrading.
- We publish an OWASP ASVS Level 3 self-assessment. Independent code review and penetration testing are planned.
- Help comes from the maintainer and GitHub. There is no staffed support desk.
How we check the code
The public repository contains the code and automated checks used to review changes.
Every change is gated
- Every merge must pass the full test suite on Ubuntu, Windows Server 2022, and Windows Server 2025.
- Static analysis, dependency checks, and secret scanning block commits on findings. Tools include bandit, semgrep, gitleaks, pip-audit, and npm-audit.
- Advisory jobs check complexity, duplicated code, diff coverage, and mutation testing results.
Dependency checks and security reports
- Daily checks scan pinned dependencies for known vulnerabilities. Dependabot also opens dependency pull requests weekly.
- Report vulnerabilities through the private security channel. Published response targets guide remediation and disclosure.
Review the security standard and assessment summary, including scope and exclusions. Use the included test harness to measure throughput on your own hardware.
Help shape the 1.0 release
Test your interface patterns and edge cases while the design can still change. Your findings help us decide what to fix next.
Run a sandbox install
Run MessageFoundry in a sandboxed, non-production environment. Use synthetic messages or a de-identified test feed to exercise your interfaces.
Tell us where it broke, what was missing, and what felt wrong.
No PHI — synthetic or de-identified data only, please.
Send feedback
Tell us what is missing, confusing, or broken. Rough notes are welcome.
Describe how your team works and what you need the engine to do.
Security flaws are the exception — those go through the private channel, never a public issue.
Become a contributor
Contribute code, documentation, connectors, or test data. Healthcare interface experience is welcome alongside Python experience.
Open a GitHub issue to discuss your proposed change. A signed Contributor License Agreement is required before a pull request can be merged.
Who builds and supports MessageFoundry
One maintainer, for now
One person currently maintains MessageFoundry. Consider that dependency when evaluating the project.
Contributors can help maintain the code, review changes, and support other users.
Built with AI assistance
A large share of the code was written with AI coding tools under human review. Changes must pass the tests and security checks above.
The source is open for your team to review. Please report what you find.
The open-source engine includes all features
All engine features are included in the open-source release.
A commercial license offers different terms for the same features. Read the licensing options →
Independent review needs funding
We estimate an external code review and penetration test will cost $25,000–$50,000. Funding is needed before that work can start.
We are seeking grants and sponsors to fund the review. See sponsorship needs →
Start with a sandbox
There is no reference list of live hospitals yet. Organization-level certifications are also future work.
Use synthetic or de-identified data for sandbox testing. Before relying on MessageFoundry for live patient traffic, assess the risks and talk to us.
Help shape where this goes
Install it in a sandbox and tell us what happened.