ECIR: Evidence-Calibrated LLM Security Assessment Agent

ECIR (Evidence-Calibrated LLM Security Assessment Agent) is a research framework for evaluating and calibrating security assessment decisions made by large language model (LLM) agents under uncertain, incomplete, and potentially adversarial evidence. The framework models security assessment as a sequence of evidence interpretation, hypothesis generation, testing, verification, and decision-making stages, with particular emphasis on the ACT, WAIT, and ESCALATE decision boundary. ECIR introduces an evidence-trust-aware evaluation protocol designed to measure not only whether an agent reaches a correct security assessment, but also whether its escalation behavior is appropriately calibrated to the reliability and completeness of available evidence. This release contains the research artifacts associated with the ECIR study, including the framework implementation, evaluation scenarios, experimental configuration, and reproducibility materials. This work is intended for research and authorized security assessment only.