AI Development Governance
Developers now install software that reads your source code, executes shell commands, holds cloud credentials, and reaches production: AI agents, MCP servers, coding assistants. Attest is the system of record for which of them are approved, and the signed evidence that reality matches the registry.
The problem
An AI agent or MCP server arrives through a config-file line or an app download, bypassing device management, dependency scanning, app-sec review, and procurement. It is the most powerful software a developer has ever been able to install, and most organizations cannot answer which ones are running. Each one can:
How it works
The source-available CLI inventories AI agents, MCP servers, AI extensions, and the unmanaged software layer they live in (Homebrew, npm, pipx, IDE extensions), matching advisories via OSV.dev. The full report stays on the device.
Each scan produces a signed record: control outcomes, severity counts, and a hash that commits to the local report, verifiable by an auditor at the machine. You choose the disclosure tier. The inventory itself is never transmitted.
Dashboards show posture per control, trends, stale devices, and the approval queue. One click approves a tool for a group; the fleet converges on the next scan. Evidence packs export for SOC 2, ISO 27001, NIST, and DORA.
The registry
Your organization declares which AI tools are approved. Every scan reconciles reality against that catalogue: unapproved tools become findings, accepted ones carry a documented owner, justification, and expiry. Continuous, not a pre-audit scramble.
Privacy
Evidence, not surveillance. The platform is architecturally unable to see source code, files, or activity, not merely promising not to look.
Raw inventory never leaves the developer's machine. What leaves, if you turn it on, is signed control evidence. The scanner's source is public (FSL licensed), so the claim is checkable, and the control plane's API has no endpoint that could receive an inventory. Read the security & privacy architecture →
Pricing
Design-partner program: the first organizations get the Team tier free for 90 days in exchange for a weekly 30-minute feedback call and a reference conversation. Apply →
Get started
The pilot is deliberately small: five devices, one team, your real AI-tooling catalogue. By day 14 you have a dashboard your CISO can read and an evidence pack your auditor can file.