Audit vendor lock in exposure

What it's for

Shows executives where a nominal backup is not a complete executable exit, how much value is exposed, and which minimum-loss replacement bundle works in each represented stress scenario.

What you give it

Inputs split into evidence read from your connected systems, calibration your team owns, and numerical controls that affect precision but never the result's meaning.

{
  "capabilities": [
    {
      "business_value_at_risk": 100,
      "current_vendor_id": "vendor-a",
      "id": "compute"
    },
    {
      "business_value_at_risk": 50,
      "current_vendor_id": "vendor-a",
      "id": "database"
    }
  ],
  "exit_options": [
    {
      "available_scenarios": [
        true,
        false
      ],
      "covered_capability_ids": [
        "compute",
        "database"
      ],
      "disruption_loss_scenarios": [
        10,
        20
      ],
      "id": "managed-exit",
      "lead_time_periods_scenarios": [
        2,
        4
      ],
      "switching_cost_scenarios": [
        30,
        60
      ]
    },
    {
      "available_scenarios": [
        true,
        true
      ],
      "covered_capability_ids": [
        "compute"

What you get back

This is the actual output of running the example above — computed by the same function the platform calls, not an illustration.

{
  "decision": "vendor_exit_coverage_within_governed_gates",
  "guardrails": [
    "An exit option counts only when it covers every required capability and is executable in that represented scenario; a roadmap idea or nominal second supplier is not coverage.",
    "Unavailable complete exit is valued at submitted business value at risk, so finance must stress losses beyond that boundary when outage, legal, data, security, or regulatory exposure can be larger.",
    "The audit is an aggregate continuity and contracting analysis—not vendor misconduct evidence, an employee score, or authority to terminate, migrate, negotiate, investigate, or disclose a supplier relationship.",
    "Heuristic set cover has no global optimality certificate; material exits require legal, procurement, security, architecture and finance validation plus an executable rehearsal."
  ],
  "method": "scenario_executable_vendor_exit_set_cover_audit_v1",
  "scenario_exit_plans": [
    {
      "exit_feasible": true,
      "exit_lead_time_periods": 2,
      "exit_loss": 55,
      "probability": 0.3,
      "scenario_id": "stress",
      "selected_exit_option_ids": [
        "compute-exit",
        "database-exit"
      ],
      "solver_exact": true,
      "vendor_id": "vendor-a"
    },
    {
      "exit_feasible": true,
      "exit_lead_time_periods": 2,
      "exit_loss": 40,
      "probability": 0.7,
      "scenario_id": "normal",
      "selected_exit_option_ids": [
        "managed-exit"
      ],
      "solver_exact": true,
      "vendor_id": "vendor-a"
    }
  ],
  "solver": {
    "global_optimality_certificate": true,
    "maximum_exact_states": 4096,
    "method": "exact_vendor_scenario_set_cover"
  },
  "summary": {
    "capability_count": 2,
    "exit_option_count": 3,

How it works

Constrained optimization — Pick the best feasible option under real limits — budget, headcount, dependencies, capacity — rather than ranking a list and hoping it fits.

1. 1 Freeze the capability-to-current-vendor map, aggregate business value at risk, coherent exit scenarios, and candidate options with capability coverage, switching cost, disruption loss, lead time, and scenario availability.
2. 2 For every vendor and scenario, solve the minimum-loss complete capability set cover exactly when the option state space fits the declared boundary; otherwise run a deterministic value-density greedy approximation and remove the optimality certificate.
3. 3 Treat scenarios without a complete executable cover as infeasible, aggregate probability and loss tails, apply governed probability/CVaR gates, and retain the scenario-level exit plan for rehearsal and challenge.

Before you trust it

Every tool in the catalog ships with the conditions under which its answer is meaningful — and the conditions under which it should abstain instead of guessing.

Calibrating it to your org

Calibration workflow

1. 1 Define the management decision, target outcome, aggregate unit, privacy boundary, cadence, and prediction/intervention horizon for this organization.
2. 2 Build a tenant-scoped historical cohort using only information available before each prediction or decision; preserve zero periods, censoring, assignment probabilities, and unresolved outcomes when the method requires them.
3. 3 Estimate statistical parameters on training history, but obtain costs, utilities, risk tolerance, practical-effect thresholds, capacity, and policy constraints from accountable decision owners.
4. 4 Validate on later time windows or held-out aggregate units at the deployment grain, against a simple baseline and the function-specific validation strategy.
5. 5 Deploy only if the returned decision clears evidence, overlap, calibration, robustness, and guardrail checks; warning, unsupported, schema-gap, and fallback decisions are abstentions.
6. 6 Monitor realized outcomes, data drift, coverage, and decision regret; recalibrate at a governed cadence or after a detected regime/definition change, never merely because a stakeholder dislikes the result.

Call it from your AI

You don't wire up 388 tools in your MCP client. The GitRevio MCP server exposes 18 tools, three of which let an agent search the catalog, read a tool's schema, and run it — so the assistant finds this one on its own.

gitrevio_capabilities_search
  { "q": "audit whether every vendordependent business capability" }
  → finds "audit_vendor_lock_in_exposure"

gitrevio_capability_describe
  { "capability_id": "audit_vendor_lock_in_exposure" }
  → returns the input schema and agent guidance shown on this page

gitrevio_capability_run
  { "capability_id": "audit_vendor_lock_in_exposure", "arguments": { ... } }
  → returns the result shown above

Works in Claude Desktop, Claude Code, Cursor, Cline, Continue.dev, Goose and Aider. See the MCP server.

Related tools

See every tool in Vendors, sourcing & build-vs-buy →