Redthread — AI risk assessment and agent security

MCP supply-chain trust · Free Your developers already installed MCP servers. Do you know what they run? Every server in the official MCP registry, scanned daily and signed: what it installs, who built it, and whether it changed hands since you approved it. Check it in ChatGPT or Claude, pin it in CI, gate it in ToolHive, and prove it to your auditors. Check your MCP servers → AI risk assessment · Free Know every AI you run, and which risks are real. One agentless scan maps your code, cloud, websites and agents, finds the shadow AI, and ranks the toxic combinations an attacker could actually use — then hands your team the fix. See the risk assessment → The Shift · AI-native security platform We are in an AI era. Traditional security will leave you in the dust. One AI-native application protection platform (ANAPP) — from the first commit to the agent in production: assess, fix, identify and enforce on one graph. See the platform → Agentic Trust & Protection Platform Evidence your identity provider can act on. Okta or Entra decide what an agent may do. Redthread adds a signed record of what it actually did, and whether it is still the agent you approved, that anyone can check. See how it works with your identity provider → New · ATPP Enforce · Preview Turn the record into a checkpoint. An inline checkpoint, in preview, that decides each request against your policy. It stays in observe mode until a review of your real traffic shows what it would have decided, and you choose to turn decisions on. See ATPP Enforce →

Start a free risk assessment

Agentless · read-only · no card, no sales call

Or check the MCP servers you already installed, free, in one command → Prefer a walkthrough? Book a demo →

Why now

MCP is stuck between the laptop and production. Security is the reason.

In Stacklok's July 2026 survey of enterprise engineers, 86% of MCP use is still experimentation or local development, only 5% runs governed, enterprise-wide production, and 49% name security and compliance as the biggest blocker. OWASP lists tool poisoning (MCP03) and shadow MCP servers (MCP09) in its MCP Top 10. A team approves a server by its name; the code behind the name keeps moving. Our signed scan of the whole registry this week:

1,111

listing swaps

Servers whose name now leads to a different domain or package owner than when first published.

222

versions that don't exist

Listings naming an npm or PyPI version that was never published.

built from another repo

Packages whose Sigstore build record names a different repository than the listing declares.

99%

of images on a movable tag

1,077 of 1,089 container images can be repointed after you approve them.

Check · Pin · Gate · Prove How it works

Figures: Redthread's daily signed scan of 42,172 servers in the official MCP registry, 12 October 2026. Survey: Stacklok, State of MCP in Software 2026. OWASP MCP Top 10.

Why the shift changes everything

01 — The shift

The agentic shift is here.

It's not coming — it's already realized. Every team now builds with AI: agents write the code, wire the infrastructure, and ship to production in hours. The way software gets made changed, and it changed for everyone at once.

02 — New surface

The attack surface exploded.

Every agent, prompt, tool and credential is a new way in — and the estate rewrites itself faster than any human can map.

03 — The gap

Old security can't keep up.

Config scanners hand you a list of what might be wrong. They never prove what an attacker can actually reach — so the path that spans layers slips by.

04 — Our solution

Our Solution.

Redthread is an AI-native security platform. At the core is a graph engine, Redthread, that maps and inventories your organization's entire AI infrastructure — every agent, tool, model, and data connection, including the shadow AI most teams don't know they're running. Then gives every agent in that graph a durable, cryptographically verified identity with our Agentic Trust & Protection Platform model.

01 / 04

Total security at AI speed, powered by Redthread.

Redthread connects code, cloud, and runtime into a unified context graph. Context enables teams to use AI to fix exploitable risks at the source, stop attacks in real time, and start secure from the IDE — automatically and accurately.

For the first time, defenders can move faster than attackers — without sacrificing precision or slowing innovation.

Agentic Trust & Protection Platform

Agentic identity + continuous trust signals, on SPIFFE.

Know which agents you can trust — in real time, not in last quarter's report.

From proof to protection: real-time trust signals for every agent in your environment.

Agentic Trust & Protection Platform is the next step: it gives every agent in that graph a durable, cryptographically verified identity — built on SPIFFE, the open industry standard for workload identity, not a proprietary lock-in — and turns Redthread's proof into a live signal. The moment an agent is proven exploitable, or a fix is verified, a signed trust-state event broadcasts to whatever is orchestrating your agents: green means verified safe, red means proven unsafe, right now. No new dashboard to babysit. No waiting for the next scan cycle.

verified safe proven unsafe

One toggle turns it on. No agent rewrites, no new infrastructure to run yourself.

Redthread

A new operating model for AI-era security

One context graph runs all three teams — from code to cloud to agent identity to defend. Red proves it, Green prevents it, Blue stops it.

From first commit to continuous coverage: one agentic security lifecycle.

It starts with the graph. Everything that follows reads from it, writes back to it, and hands its context to the next step.

Graph

Connect agentless — every agent, repo, workload, identity, route and data store in one picture

Assess & prove

toxic combinations ranked · exploit validation on the critical paths

Live

Shadow-AI discovery

Candidates with an honest coverage banner — confirm to register

Repos live

Data security posture

What sits in your stores, through the same agentless role

Operator-enabled

Cloud and infra scanning

CVSS-scored checks across compute, storage, identity, network, K8s

Operator-enabled

Cross-cloud risk analysis

Federated trust between AWS, Entra ID and GCP

Operator-enabled

Realtime monitoring

An optional eBPF sensor beside your GuardDuty, Defender and SCC findings

Enterprise · detection only

Availability The estate assessment — code, websites, agents, and one-click cloud for AWS, Azure, Google Cloud and Oracle — is live, self-serve and free. Exploit validation is live per scan. Network and detection scan types are enabled per tenant. The eBPF runtime sensor is an Enterprise add-on that detects and never blocks.

Then, on every change

Four things the graph makes possible.

Each of these reads the same estate the steps above built — which is why a change can be judged against what is already true in production.

01 New features deployment test

Test the release that changed, not the whole app again:

A baseline per target — only what changed is re-covered
An unchanged commit short-circuits: no scan, no charge
Recon carryover reuses the learned architecture and endpoints

Live

02 Constrain agents

An AI agent is an identity with permissions, and most have more than anyone intended:

Excessive-agency and tool-abuse testing
What the agent’s identity can actually reach, through the graph
The gap between scoped and reachable is what you constrain

Live

03 Code fix

A finding becomes a change your engineers review, never one we merge:

A minimal patch as a draft pull request on your own repo
Located by the identifiers the finding names — vendored and minified files excluded
Dependency updates proposed per CVE, with VEX decisions exported

Live

04 Prevention and response

The cheapest moment to stop a risk is before it exists:

The PR gate fails a change that would introduce an attack path
The GitHub Action gates the build — fail-on critical, high, medium, low, or never
A ticket in Jira or ServiceNow with the full path attached

PR gate live · runtime response roadmap

Where this does not go

Redthread is a testing tool for staging and source, not a production runtime firewall. The optional eBPF sensor detects and never blocks, kills or quarantines. Real-time endpoint prevention (isolate a host, kill a process, quarantine a file) runs through a connected partner engine — the integration is live, and it activates the moment a partner is connected to your workspace. Admission control and cloud guardrails remain on the roadmap.