Imandra: formal models and reasoning for financial systems

Markets’ System Auditor compares outcomes with the formal model and presents individual traces and aggregate statistics. That is particularly relevant when a rule change affects interactions that are difficult to cover with a few manually selected examples. The useful deliverables are the model, the checks and the deviations found; claims of improved profitability or universal reliability remain vendor marketing.[1]

Imandra Protocol Language, or IPL, encodes rules of engagement such as FIX specifications. Connectivity uses that model to generate documentation, simulations, onboarding scenarios and certification reports, with Simulator and Proxy certification modes. Its flow analysis relates production logs to modelled cases. Rule Synthesis can infer patterns from historical messages, but Imandra itself says the resulting model still requires manual review because logs may not capture the full interface.[2]

ImandraX is the reasoning engine beneath these workflows. Its IML language is based on a pure subset of OCaml, and its interfaces include HTTP, Python, OCaml clients and MCP. A Visual Studio Code extension exposes interactive proof work. These interfaces connect an engineering workflow to mathematical analysis; they are not described as broker order-routing connections.[5]

The IPL setup guide pairs a Visual Studio Code plugin with the Imandra CLI and an Imandra account. The plugin offers language-aware editing, HTML documentation generation and a customizable Markdown template, plus authentication and zone selection. This makes the specification a maintained source artifact rather than a document that must be separately rewritten after every protocol change.[6]

The homepage publishes the following Imandra Universe plans. These are reasoning-tool subscriptions; the page does not present them as the price of a full venue model, connectivity deployment or enterprise implementation. Amounts use the displayed dollar sign, without an explicit currency code or tax treatment on the cards.[7]

Universe centralizes subscription selection, billing and API keys for ImandraX, CodeLogician and SpecLogician. The account guide starts with choosing a plan, generating a key and connecting the required tool. An enterprise buyer should obtain the applicable usage allowance, treatment of submitted requests and commercial service terms with that selection.[8]

The Microsoft Marketplace listing offers an enquiry route for customer-Azure virtual-machine deployments, without a public enterprise price. A quotation needs to specify model-building, implementation and support as well as software access.[9]

CodeLogician is delivered through a command-line package, an MCP server and supporting agent guidance. Its installation guide requires a Universe API key; the installer bundles Python 3.13, while a separately managed Python installation must be at least 3.12. The MCP server is included in the package. Agent guidance provides instructions, while the CLI or server performs the reasoning requests.[10]

The enterprise offer combines a virtual machine in the customer’s Azure tenant with CodeLogician and a chosen language model. It includes Ponens as an open-source record of reasoning and policy checks. The deployment boundary should account for any external model connection.[9]

The contact page provides general and support enquiry paths, a product field, email and a US telephone number. It lists Austin as headquarters and a London office. It does not publish support hours, severity-based response times or restoration targets there; enterprise coverage therefore needs to be defined in the purchased service.[13]

The central documentation index separates ImandraX, CodeLogician, SpecLogician and IPL, with a separate Universe access guide. That separation helps assign an issue to its actual layer: account access, language modelling, protocol tooling or the reasoning engine. The index supplies a starting reference; it does not itself promise a staffed service entitlement.[18]

Connectivity’s certification concerns conformance to the modelled interface and selected onboarding scenarios. A generated report is technical evidence for the system owner. It does not itself grant permission to operate a brokerage, venue or investment service, or establish that all of that firm’s regulatory obligations have been satisfied.[2]

The external-dependency guide makes the proof boundary explicit. An opaque function supplies a type without its implementation; a counterexample may therefore reflect missing information about that dependency. Added axioms are assumptions that need independent justification. An approximation restores executable behaviour but proves properties of the approximation over its chosen range. These distinctions determine which conclusions can reasonably transfer from a formal model to production software.[14]

A model can be accepted by the engine yet remain non-executable when it contains opaque functions. In that case the documentation says test generation is unavailable, even though some properties can still be proved. The implementation needs to distinguish a checked model, an executable model and evidence that the intended source-system behaviour is represented.[11]

The legal page identifies Imandra Inc. and its subsidiaries as the product group, and retains Aesthetic Integration and The Logic of Financial Risk as associated trademarks. Its public policy headings do not by themselves establish a retention period, cancellation rule or contractual service level; those belong in the applicable product agreement.[15]

The current company page names Denis Ignatovich and Grant Passmore as cofounders and co-CEOs. It describes a combination of financial-market experience and formal-methods research. These backgrounds help explain the product focus, while the suitability of a particular model still depends on the documented system and analysis performed.[16]

Imandra also identifies Aesthetic Integration Research Corporation as a wholly owned subsidiary through which it undertakes US government work. That entity is relevant to understanding the wider group; a commercial capital-markets order should still specify the actual contracting company and the product being supplied.[17]

Operator

Imandra Inc.

Service scope

Formal modelling, protocol certification and software reasoning for capital-markets systems.

Customer types

Trading venues; Brokerage technology teams; Capital-markets engineering, quantitative and risk teams

Delivery

SaaS; Hosted; API

Pricing publication

Public and quoted pricing

Headquarters

Austin, Texas, United States; London office

Platforms

Imandra Markets; Imandra Connectivity; ImandraX; Imandra Universe; CodeLogician; SpecLogician; Imandra Protocol Language; Ponens

Integrations

FIX specification modelling; HTTP API; Python; OCaml; MCP; Visual Studio Code; Microsoft Azure

Pricing scope

Public Universe developer plans; enterprise framework and implementation require enquiry.

Implementation

Universe API access and developer tools; a customer Azure virtual-machine option is advertised for enterprise deployments.

Support

Product-specific contact form, email and US telephone; enterprise response commitments require agreement.

Permissions and regulatory scope

Engineering assurance and technical conformance evidence; financial-services permissions remain with the operating firm.

Provider metadata checked 21 Oct 2026Source 3Source 9Source 7Source 15Source 8Source 13Source 2Source 17Source 1Source 5Source 4Source 6Source 14

The Markets page labels Imandra Autopilot as coming soon; purchasing specifications should therefore exclude it from currently available functions.[1]

A useful first scope is one bounded protocol or decision rule, together with its specification, representative execution traces and explicit properties to check. CodeLogician’s documented loop supports progressively refining the model and examining counterexamples. Success for that exercise is a reviewed set of behaviours and tests; broader production coverage requires a correspondingly broader and maintained model.[3]