Read-only
Pull-only. Outbound path.
Never listens. Per-host enrolment tokens. Auth over TLS today; mutual TLS lands in a hardening pass before GA.
The security layer for AI agents
Every AI agent on your fleet. On one radar.
Sekeye sweeps your laptops and servers and surfaces every MCP server, agent, skill, and model. Then it shows you which ones hold your credentials, a shell, or a line to the open internet.
Meet DrigSekeye's endpoint agent. Read-only. No LLM on the box.macOS · Linux · Windows
Why now
The agent and supply-chain campaigns Sekeye is built to surface.
The agentic wave leads this row, and most of it is server-side: MCP servers exposed in production, agents holding deploy credentials, an autonomous agent reaching internal datasets. The npm and extension campaigns trail as the base layer we still cover. Drig streams inventory on a pull-only agent; when a new wave lands, retro-match re-runs matching across current fleet state server-side, no rescan on the host, no new agent release.
Prod infra
autonomous agent → internal datasets + service creds
Hugging Face agent breach
2026See the brief →
Agent-run
ransomware executed by an LLM agent · Langflow CVE-2025-3248
JadePuffer
2026See the brief →
CISA KEV
MCP command injection · CVE-2026-42271 · actively exploited
LiteLLM
2026See the brief →
AWS creds
malicious workspace MCP config auto-loaded → cred exfil
Amazon Q config exfil
2026See the brief →
4 agent hosts
MCP-stdio RCE · Cursor · VS Code · Windsurf · Claude Code
MCP-stdio RCE
2026See the brief →
In-the-wild
malicious MCP server · BCC exfil
postmark-mcp
Sep 2025See the brief →
796
npm packages · self-replicating
Shai-Hulud 2.0
Nov 2025See the brief →
2.6B/wk
download reach · 18 packages
chalk · debug takeover
Sep 2025See the brief →
35.8K
installs · VS Code + OpenVSX
GlassWorm
Oct 2025See the brief →
2.6M
users · 35 extensions
Cyberhaven wave
Dec 2024See the brief →
100
backdoored models · 25 unsafe-deserialisation
Hugging Face models
Feb 2024See the brief →
Browse the full library →
Every incident here is cited from published research, and the cards link through wherever we have written the brief. Catalog freshness targeting under four hours at GA.
AI-agent & MCP governance
The agents running on every host, with your creds, your shell, and no supervisor.
AI-agent security lives on the host where the agent runs, not in the gateway it might route through. Laptops and servers pull in MCP servers, agents, skills, and models every day, most of it never reviewed.
What a blast radius is
If this agent were compromised right now, how far would it reach? Sekeye profiles what each one holds, filesystem, credentials (names, never values), shell, egress, and resolves it to one verdict:
Verdict · dev-01-macBlast radius: High
claude-code 2.1.201
- 🔑 credentials · AWS_* · GITHUB_TOKEN (names, not values)
- ⌘ shell · can spawn
- 🌐 egress · api.unknown-host.io
- 🔧 tools · 14 of 17 ungated
Holds your AWS keys, can spawn a shell, and reaches a host nobody recognises.
EDR watches the OS, not the agent
An agent reading a credential file is ordinary developer workflow at the syscall layer. “Which agents are installed, and should they be here” is a different question.
- Shadow AI is an inventory problem
- Agents arrive sideways, update without asking, and inherit whatever credentials are already there.
- Servers, not just laptops
- Most of the crown-jewel damage in the recent wave was server-side. One fleet, one agent.
- Packages and extensions, still covered
- The classic supply chain became the base layer. Same host, same snapshot, same catalog.
See → Govern → Catch
One is live; two are being built. Buy the phase that exists, not the one on the slide.
- 01Shipping
See
Find every agent, MCP server, skill, and model on every host. Blast radius for each, ranked against live threat intel, with the fix and rotation steps.
- 02Next
Govern
Decide what an agent is allowed to do, and know when its configuration changes underneath you. In build, not available today.
- 03Later
Catch
Notice when an agent starts acting outside its envelope. This is the phase that earns the word detection, and we won't use it before then.
See Drig work
Discover · Blast radius · Prioritise · Rotate · Evidence.
Five moments of a real agent-incident response, shipping today. The sixth tab is labelled, you can tell what exists from what doesn't.
02 / 06
How far would this one reach?
Files, credentials, shell, egress, ungated tools. One verdict per agent.
sekeye · blast-radius
- claude-code · dev-01-mac
shell + AWS + egresshigh - ↳ credentials in env
AWS_SECRET_ACCESS_KEYname-only - ↳ filesystem scope
$HOME (unscoped)broad - ↳ can spawn shell
yeshigh - ↳ ungated tools
14 of 17review - ollama · llama3:70b
local, no credslow
For the person actually holding the CLI
Drig is a single Go binary. Read-only, pull-only, no LLM on the box.
It runs as an ordinary service on a laptop or a production server, and it never listens.
dev@laptop:~
> drig
- read-only
- pull-only
- no LLM on the box
One static Go binary, about 10 MB, on a laptop or a production server.
POST /v1/snapshots (redacted, 1 artifact shown)
{
"host_id": "e1b0f7…",
"host_role": "server",
"scan_ms": 32,
"surfaces": 9,
"artifacts": [
{
"surface": "mcp_server",
"name": "postmark-mcp",
"version": "1.0.16",
"hash": "sha256:2f8a…",
"source": ".mcp.json",
"transport": "stdio",
"can_spawn_shell": true,
"env_var_names": ["POSTMARK_SERVER_TOKEN"],
"tool_count": 4
}
]
}Environment variable names travel, so we can tell you an agent is holding a Postmark token or your AWS keys. The values never leave the host, and ingest rejects any record carrying them.
Trust. The honest version
No logos yet. Here's what we've earned.
Signed
Ed25519 across the wire.
Binaries, update manifests, catalog bundles, campaign payloads. All verified before any custom collector runs.
Deterministic
No LLM on the box.
Drig is rule-based. Matching runs server-side against the signed catalog. Nothing probabilistic on customer machines.
Never collected. The ingest schema rejects it.
- env values
- file contents beyond manifests
- browser history
- credentials
- keystrokes
What Sekeye does not do yet
Read-only today
Drig observes and reports. Nothing is blocked, gated, or quarantined on your machines.
Govern and Catch are roadmap
Deciding what an agent may do, then noticing when one turns. In build, not shipped.
Not an EDR
No process or syscall monitoring. We run alongside the one you have.
Not a log lake
Bounded inventory and findings, not a firehose. Do not buy this to replace a SIEM.
Design partners, not customers, yet. White-glove pilot, a direct line to the engineering team, founding-partner pricing locked through GA. In return, you help shape what ships next.
What waiting costs
Your engineers are running AI agents with your credentials and your shell. Ungoverned, on laptops and servers.
Your EDR watches the OS. Nobody watches the agent. Take thirty minutes and we will walk the console live against a real agent incident, then show you the blast radius of every agent on a host like yours.
Book a call
30 min · video · design-partner cohort
- ✓Free pilot, limited design-partner cohort, founding pricing locked through GA
- ✓Read-only agent, no LLM on the box, no kernel module, removal leaves nothing behind
- ✓Live blast-radius walk-through against a real agent incident
- ✓No pitch deck. No CRM drip.
You pick the slot in the modal. Calendly loads on click.
Not ready? Email chirag@sekeye.com or apply to the design-partner cohort.
FAQ
Short answers.
Is Sekeye an EDR?
No, and it will not become one. Your EDR watches the operating system. Sekeye watches the AI agents running on top of it: what each one is, and its blast radius. Watching what an agent does is the Catch phase on our roadmap, and even then we plan to read the logs agents already write rather than hook the kernel. The syscall layer stays your EDR's job. We run alongside it.
What does Sekeye do today, and what is still roadmap?
Shipping today: discovery of every AI agent, MCP server, skill, and local model plus the classic package, extension, and OS-package surfaces on laptops and servers; a blast-radius profile per agent; prioritisation against live threat intel including AI-infrastructure CVE and CISA KEV; and remediation with ordered credential-rotation playbooks. Roadmap, clearly staged: Govern, deciding what an agent is allowed to do, is next, and Catch, finding out when one turns, follows. The Drig agent is read-only today: it does not block, quarantine, or kill anything.
What does Sekeye deliberately not do?
Runtime behavioural analysis and process blocking, that's the EDR layer we coexist with, not replace. We're also not a log lake: we surface findings rather than warehousing your activity stream. No TLS interception or browser DLP (integrate your CASB instead), no kernel-level syscall monitoring (we read what your existing sensors already produce), and no code-level analysis or sandboxing of marketplace software. Each of these is either covered elsewhere in your stack or honestly not our surface.
What does Sekeye never collect?
File contents beyond manifests and configs, environment variable values (we take the names of MCP environment variables, never the values), browser history, credentials, and keystrokes. The ingest schema rejects any record carrying an environment value, and the agent hard-denies credential stores at the filesystem layer. These are permanent product commitments, not MVP simplifications.
Can we self-host Sekeye?
Yes, and it is worth separating the two halves. The console is one deployment you run on your own infrastructure, air-gap capable behind an offline licence. The agent is what lands on each endpoint: signed installers for Mac, Linux and Windows, pushed with whatever you already use to manage laptops and servers. One console, every endpoint. Fleet size changes how you size the console, not how you deploy it. Same binaries as our SaaS, never a fork. Self-hosting matters here because agent inventory reveals which teams run which AI tooling, and plenty of buyers will not send that off-premises.