Exposure engine
Blast radius. Live intel. Retro-match.
Two things decide what rises to the top of the queue: how far each agent and MCP server on your fleet could reach if it turned, and which of them is being exploited today, including the AI-infrastructure CVEs that never show up in a package advisory. A new incident lights up existing fleet state without a rescan on the host.
Ingestion
Where the catalog comes from.
Public feeds for the classic base layer, plus two sources built specifically for the AI layer: the CVEs landing in agent infrastructure, and a curated record of MCP servers, skills, and models caught acting against their user.
AI-infrastructure CVEs and KEV
The bugs that land in the agent stack itself: command injection in an MCP endpoint, RCE over MCP stdio, an exposed inference gateway. The LiteLLM MCP flaw (CVE-2026-42271, on CISA KEV) is the shape of it: one bug in the proxy exposes every provider key behind it. Tracked as its own class, not buried in a package feed.
A curated malicious-AI catalog
MCP servers, agent skills, and model artifacts caught acting against their user: the postmark-mcp exfiltration pattern, backdoored model weights. This is the surface no public feed indexes yet, and building it is where our work goes.
The standard public feeds, for the base layer
Known-exploited and severity intel for the classic package and extension surface, so a vulnerable dependency on a host is ranked alongside everything else, not in a separate tool.
Signed, so you can trust the verdict
Intel ships to your fleet in Ed25519-signed bundles. Severity carries through from the authoritative source rather than a score we invented.
Principles
What the engine does differently.
Each one shows up in a finding you can read out loud in an incident call.
Blast radius, not just a version match
A vulnerable package is a version number. A compromised MCP server is a set of capabilities. For every agent and MCP on the host, a finding reads as “this coding assistant holds your AWS keys, a shell, and egress to a host nobody recognises”, not as a CVSS number.
Ranked by what is being exploited now
Live intel on what is actually under attack today, not just what carries a high score in theory, so the queue reflects real-world risk order.
Retro-match
When new intel lands, matching re-runs across your current inventory. No rescan on the host. A new campaign lights up existing fleet state in minutes.
Fresh
Target: a new public incident becomes a ready campaign in hours, not on your next scan cycle. The exact window firms up with design-partner data.