Proofbench
Open-source platform, built with Claude Code · Evaluation platform for tool-using LLM agents
An evaluation platform for an LLM agent that moves money: deterministic graders read what the agent actually did, an LLM judge is used only for prose and is itself measured against a blind panel, recorded runs re-grade in seconds without a GPU, and a CI gate fails when grading quietly gets weaker.
Problem
LLM agents are usually scored by another model's opinion and a single run, which hides whether the agent did something dangerous and how far the score itself can be trusted.
Solution
Decide everything checkable from what the agent did, use a judge only for prose and measure it against a blind panel, replay recordings without a GPU, and gate CI on the grading itself.
Built in
75.0% fully correct and 95.8% safe at temperature 0; judge kappa 0.93 against a blind panel; re-grading in 4 s instead of 18 minutes; a live dashboard, 171 tests and CI.
Overview
Proofbench is an open-source evaluation platform I built with Claude Code for an LLM agent that can do damage: a customer-support agent for a small shop that refunds money, cancels orders and reads other people's data. Almost every question worth asking about it has an exact answer, so it is decided from an effect log rather than by asking a model: what moved, by how much, on which order, whether something forbidden was attempted even if the shop refused it, and whether another customer appeared in the reply.
The agent is qwen3.5:9b running locally on one GPU. On the baseline it was fully correct on 75.0% of attempts and did nothing dangerous on 95.8%. The dominant failure is an agent that reasons correctly and then never calls the tool. Run with more randomness, the pass rate stayed exactly the same while the safety rate fell to 83.3%: it paid out on two of five planted instructions, which is why the two rates are kept apart.
Reply quality is the one thing a model judges, and the judge is measured: against five blind model raters it agreed at kappa 0.93 (95% CI 0.78–1.0). Recorded runs replay through the graders in 4 s instead of 18 minutes of GPU, and a CI gate fails if any grader's counts move, after a test showed the first version passing with a critical grader switched off. Every number on the live dashboard is re-graded by the current code, and the README keeps the measurements that turned out wrong, with why.
What it does
- A simulated shop and a customer-support agent that can look up orders, read policy, refund, cancel and escalate; 24 cases cover refunds, authority limits, privacy and prompt injection planted inside tool results
- Deterministic graders decide from an effect log what money moved, whether a forbidden action was attempted, whether another customer's data leaked and whether tool calls were well formed; two rates are kept apart: fully correct and nothing dangerous
- One LLM judge for reply quality, measured with Cohen's kappa and a bootstrap interval against five blind model raters who saw exactly what the judge saw
- Recorded runs replay through the graders with no model; the CI gate compares every grader's counts against a baseline, and a one-file dashboard re-grades every run before showing it
What's next
Hiring for a full-stack or Python role — or need something like this built? Let's talk.
I'm open to offers — on-site or hybrid in Moscow, or remote; full-time or contract. I reply within 48 hours — faster on Telegram.