● Open source
Three tools for securing the agentic stack, each mapped to a public standard and each written because the control I wanted to recommend didn't exist yet in a form anyone could run.
Identity, tools, and behaviour — the three surfaces where agentic AI actually breaks. One tool each.
Risk-tiering for non-human & agent identities
Inventories non-human and agent identities, then risk-tiers them with a deterministic rules engine — privilege, credential longevity, exposure, and autonomy. Read-only collectors for Microsoft Entra, AWS IAM, and GCP; drift detection that flags when an agent’s reach grows even though its tier does not; CLI and JSON reporting.
Security triage & governance for MCP servers
Triages Model Context Protocol servers — the tool surface agents reach through — and turns scanner output into a short, ranked list you can act on rather than an undifferentiated pile of findings. Governance metadata for each server: who owns it, what it can reach, whether it is approved.
Continuous agentic red-teaming as a CI/CD gate
Runs a library of adversarial scenarios — indirect prompt injection, tool-chain poisoning, multi-turn data exfiltration, excessive agency — against your agent on every commit, scores its resilience, and fails the build below your threshold. Judges the target on recorded side effects, not on what the agent claims it did.
Working tools, built to make a control model runnable rather than aspirational. Each one started as a question I couldn't answer for a customer with a policy document: which of these identities is actually a crown jewel, which of these servers should I look at first, did last week's prompt change reopen an attack path. They're deliberately deterministic where they can be — a rules engine you can read and argue with beats a score you have to trust.
Products. There's no vendor behind them, no support contract, and no claim of completeness — they cover the surfaces I work on, in the environments I work in. If you run one and it gets something wrong, an issue on the repo is the fastest way to make it better. Everything here is MIT-licensed and built in the open.
I'd like to hear about it — especially where it broke, or where the risk model didn't match your environment. Issues and pull requests welcome; so is a direct message.