| What it does | AI security agent that finds vulnerabilities in AI-built apps, prepares fixes, and verifies the live app after deployment
| Open-source security for AI coding agents
|
|---|
| Stage | Startup
| Not given
|
|---|
| Founded | 2026
| Not given
|
|---|
| Based in | US
| GR
|
|---|
| Pricing model | Free trial
| Open source
|
|---|
| Pricing | Free scan with no card required. 7 days free trial with card, then $80/month USD. One organization with up to three included full-access people. $20/month per additional full-access person.
| Open-source sensor is free. Enterprise pilot for up to 25 developer seats starts with a 90-day design-partner pilot, scoped with you.
|
|---|
| Key features | - Continuous attack-surface mapping of exposed endpoints, services, and certificates
- Vulnerability investigation with confirmed evidence and real impact explanation
- Automatic fix pull requests on separate GitHub branches
- Live verification that vulnerabilities are actually closed after deployment
- Team notifications via Slack, Discord, and email with weekly summaries
- Detection of exposed endpoints, leaked keys, open buckets, and injection paths
- Domain ownership verification via DNS TXT record
- Live retest to confirm vulnerability closure after fix deployment
- Plain-English vulnerability titles with technical details in records
- Multi-domain support on single surface map
| - Records tool calls from Claude Code, Cursor, Codex, GitHub Copilot and other agents
- Detects risky sequences and agent behavior patterns
- Forwards to SIEM: Splunk, Elastic, Microsoft Sentinel, Google SecOps
- MCP server scanning to detect risky or malicious integrations
- Works on Windows, Linux and macOS without kernel driver
- DLP integration to prevent credential and sensitive data exfiltration
- 0 false positives across 57 test cases with MITRE ATT&CK coverage
|
|---|
| What makes it different | - Verifies vulnerabilities are actually fixed by testing the live deployed app after fixes ship
- Prepares actionable fix pull requests you review and control before deployment
- Designed specifically for AI-built applications that ship vulnerable code by default
- Continuously monitors your changing app surface and checks again automatically
- Shows evidence behind every finding so you can verify the work yourself
| - Hash-chained records can be verified offline, catching any tampering or editing attempts
- Sees which AI agent ran the command and the session it belongs to, unlike EDR tools
- No account required, no telemetry sent until you configure a sink
- Single maintainer, self-funded, built in public with no hidden development
- All claims on the website verifiable by running commands on your own machine
|
|---|
| Community votes | 0 | 0 |
|---|
| DR (Domain Rating by Ahrefs) | Not checked yet ● no change since last check | 36 ● no change since last check |
|---|
| Trust Flow (Majestic) | 6 | 5 |
|---|
| Citation Flow (Majestic) | 21 | 18 |
|---|
| Referring domains (Majestic) | 4 | 45 |
|---|
Zoltra
Agentmetry