Ship-readiness + cert
Pre-Deploy Audit
A 4-axis safety audit + a publicly verifiable CERTIFIED badge. Stops you shipping an unsafe, over-privileged agent.
More detail →The question no datasheet answers: every vendor secures agents one at a time. We ask what a set of individually-permitted agents can assemble together — the coalition that is dangerous only as a union — and refuse it as a set, before it forms (door 60, CHAINGRAPH). Inventory and runtime monitoring qualify us; the set question is why we are in the room.
Rules don't stop a hijacked agent from draining a wallet in twelve seconds — or deleting a database in nine. INTEGRITAS is a runtime cage: an agent provably cannot act outside its mandate — and we prove it, cryptographically, on every action.
Everything we make, grouped by the agent's own lifecycle. You buy by group — pick the stage you're in and we handle the rest. Need everything? Take INTEGRITAS ONE.
Before an agent touches production, prove it is what you think it is — audit it, grade its containment, and x-ray what it hides. Everything below is included in this group.
A 4-axis safety audit + a publicly verifiable CERTIFIED badge. Stops you shipping an unsafe, over-privileged agent.
More detail →Grades every agent on a single Containment Grade (CG 1–10, where 10 = fully contained). Stops shadow, over-privileged & drifting agents.
How it works →Scans the six things no human can see — poisoned memory, scheming, collusion, shadow agents, latent capability, sleeper triggers.
How it works →Verify-on-load model attestation. Blocks tampered or unsigned weights before they run.
Attests everything the agent ingests at runtime — prompts, retrieved docs, tool replies, model version — that a build-time SBOM never sees.
See it live →Proof the model isn't hiding capability because it senses the test. Stops sandbagging & eval-awareness.
See it live →“Securing MCP systems requires treating the agentic environment as a continuum.” — and, on page 11: “MCP-aware security proxies remain limited and are still maturing.”
A signals-intelligence agency now writes design guidance for the protocol your agents speak. Its named concerns — “serialization risks, trust boundaries, and agent misuse”; “dynamic tool invocation, implicit trust relationships, and context sharing”; and that “misaligned assumptions or subtle inconsistencies at any stage can propagate and compound into exploitable conditions” — are the runtime cage below, stated by a neutral authority. The proxy it calls immature is what MCP-Containment is: every MCP message intent-bound before it executes, every tool schema hash-attested, a tool description treated as self-attestation and never as evidence. We quote only the sentences we can attribute; the sheet is 17 pages and yours to read at media.defense.gov.
At that cadence the probability that every MCP server in your estate is patched right now is, permanently, about zero — not a failure of diligence, a property of the number. So patching is hygiene, not a strategy. The strategy is to bound what a compromised server can reach whether or not it is patched today: every MCP message intent-bound before it executes, every tool schema hash-attested, every credential caged. That is the whole pitch, and it is arithmetic, not fear. Counted by us in the National Vulnerability Database; the number is regenerated, never typed.
14%
A rescan of more than 90,000 open-source MCP servers and 630,000 tools (30 September 2026) found that nearly 17,000 servers ship a destructive or irreversible tool. Of those, 14% declare it. Seven in ten servers give the agent no useful guidance when a call fails. A score grades that server and admits it; a gate does not. Unsigned does not load — and a destructive tool that does not say so does not load in front of a superintelligent AI agent either.
“Off by default”
Four security advisories in six days on the protocol’s official SDK, 88.6 million downloads in the window. The protocol’s own SDK notes say that “a valid token for another service was also accepted by your MCP server” — affected since version 1.6.0, twenty months of releases. The fix adds an audience check that ships off by default, and the notes say so plainly: “upgrading alone does not fix the issue”. A WARRANT receipt is bound to the resource by construction: a mandate for service A is not a mandate for service B, and no flag has to be turned on for that to hold.
The attestation says where, not what
Twice in four days a malicious release shipped with a valid registry provenance attestation from the project’s own release pipeline; one was flagged eleven minutes after publication, and its rogue commit “never went through a pull request”. The researchers’ line: “The attestation says where a package was built. It doesn’t say the code is safe.” A registry attestation is an input to review, not a pass. MCP-Containment refuses what the operator has not signed: what the operator signed loads; everything else, attested or not, does not.
The core containment layer. An agent is only as safe as the stack it runs on — its keys, tools, the MCP it speaks, its memory, the screen a human signs, and the path it takes. This group cages every one.
Binds the agent to a signed action path and blocks any step that leaves it — fail-closed, ML-DSA-87 sealed. Stops multi-step attacks built from individually-permitted actions.
More detail →Seals the wire between agent, model, tools and router — every message bound end-to-end and stopped before execution if it is rewritten in transit. Seals the transport plane of the harness. The channel a compromised gateway would use to change intent after the decision.
Watch a router rewrite get blocked →An agent never sees a human's key. Stops key exfiltration, unauthorized signing, wallet drains.
Protection for the human multisig surface (Safe / Squads / Gnosis). Born from the $15.18M recipient-swap. Stops recipient-swap & blind-signing.
More detail →KeyCage for fully-autonomous transacting agents. Stops hijacked autonomous transactions.
Every MCP message checked before it executes. Stops tool poisoning, prompt injection, tool-graph drift. A pasted skill URL is not a signature: unsigned does not load. One consumer device now installs a skill from one URL across up to five devices; the entry point is the package, not the prompt. And a payload that sleeps in memory and wakes on recall is caught by the one control that reads the package at load time, before anything is remembered.
The signed config — the rule of door 4. The agent refuses its own unsigned configuration, and the refusal is on the record: a change to its settings, hooks or tool configuration takes effect only when you signed it — even one that looks like it narrows the agent. 131 doors across 17 planes, unchanged.
Covers every connector & startup step the agent loads at launch. Stops injected or altered tool connectors.
A tool that changes after you approved it is blocked. The dedicated answer to tool poisoning.
Tamper-evident agent memory. Stops "poison once, exploit forever."
Measured on house shapes (twenty house-shaped scenarios, n = 2,000 runs, October 2026 — the published scenarios are not public yet): a goal one agent leaves in memory for its successor arrives without the authority to act on it: in sixteen hundred attempts to turn such a goal into an effect, none ran; and a secret smuggled through memory was used in none of thirty-five hundred attempts. Two of the twenty scenarios are messages a mandate cannot see; they are stated here, not claimed.
What you see is what you sign. Detects UI tampering, injected-JS render swaps & address spoofing — the Bybit-class attack.
More detail →Labels that travel with information as the agent reads, derives & sends it. Stops semantic exfiltration — the "summarise-then-email" leak.
See it live →An agent's authority graded and enforced on our own Containment Level ladder (CL 1–12, where 1 is the most contained — the inverse of the Census grade). CL 1–7 the agent acts on the world; CL 8–12 it acts on itself. Stops an agent acting above the level it was trusted with.
More detail →One verifiable chain across every layer — tool → counterparty → payload → intent → screen → settlement. Stops any single-layer break.
A single guard can't see what agents do to each other. This group governs the coalition — delegation chains, policy across the fleet, and covert coordination one agent can't reveal.
Policy enforcement across many agents acting together — the cross-agent rules a single guard can't see.
More detail →Intent-binding + verifiable delegation tokens for agent-to-agent calls. Stops spoofing & over-claimed delegation.
The coalition, not the agent — how agents coordinate across legitimate channels. Stops mutual-approval rings & covert coordination.
See it live →Agentic IAM for non-human identities: the authority chain — agent hands power to agent, hop after hop. We verify it cryptographically, so authority can only narrow. Stops silent authority amplification.
See it live →Cover the whole journey — prove the protection still works every day, keep it compliant, watch for drift, and contain it if an agent ever gets loose.
"200 is a red flag." Independent daily proof that a security product actually works — and fixes what doesn't. Stops a control that silently stopped working.
Scores a deployed agent's behaviour over time and flags silent drift before it becomes an incident.
More detail →Counterparty & transaction screening vs sanctions, the drainer (HERD) registry & AML — verdicts on identity & risk, never amount. Stops sanctioned / drainer counterparties.
Turns MiCA, the EU AI Act and more into runnable PASS/FAIL policy your agents are checked against automatically.
More detail →Reserve-deviation & attestation-staleness monitoring for the stablecoins your agents touch. Stops de-peg / reserve failure.
More detail →Post-incident containment, forensics and SLA-bound response when an unconfined agent is already loose.
More detail →Real-time monitoring of the cross-chain bridges your agents rely on — detects the exploit pattern in minutes. Built after $605M+ drained in a month.
Every group above is one application of a single containment platform. Here's the foundation — the agent harness (131 doors across 17 planes) that governs the action, the constitutional OS that sets the rules, the engine that builds each harness, full-harness coverage across every plane, and the front door every agent is born through. Every door fails closed by construction: missing evidence, an unknown value or an unsigned part is a refusal, never a pass.
The enforcement infrastructure itself: 12 capabilities across 5 layers, out-of-context. A hijacked agent provably cannot act outside its signed, capability-bound plan — every action checked, tiered by consequence, and sealed. The harness the industry did not build yet.
An agent's real attack surface is everything it loads, ingests, reasons over, signs, hands off, sends across the wire — and now the isolation its operator merely declares, and the composition no single component is responsible for. We mapped it end to end and enforce every door deterministically, fail-closed, ML-DSA-87 sealed on every verdict.
Between 21 July and 6 August 2026, four organisations disclosed the same thing: code inside an environment its own operator believed was isolated reached a real third party. Every one of those environments was declared isolated. None was independently witnessed. The load-bearing control was never the model's behaviour — it was the isolation property, and that property was asserted by the party being assessed.
The Constitutional Operating System for autonomous agents. INTEGRITAS contains the agent's world; SENTINEL-OS governs its every action — each checked against an immutable, human-signed constitution and proven in-mandate before it runs. Acting outside the mandate is mathematically impossible.
An agent is a model plus a harness. HARNESS-OS generates, validates, observes, secures and self-heals the harness around every agent. One lifecycle.
The mandatory front door for creating any agent: no muster = no credential = the agent cannot run. We govern at creation, not discovery — shadow AI becomes structurally impossible. Every agent is named, certified, harnessed and visible to the blue team the instant it's born.
A single Containment Grade (CG 1–10, 10 = fully contained) for every agent, every mandate, every access path — across identity, access, tools, permissions, mandate, regulations and ownership — with mandate enforcement that stops the drifters, and a verifiable certificate (not a dashboard claim).
Census shows what an agent can reach; X-Ray shows what it thinks, hides and conceals.
A federal policy approved in July 2026 gives every federally funded institution 180 days to stand up a review entity for its AI systems, and allows audits of up to a quarter of the attestations that come back negative, with five years of ineligibility for a failed one. The policy names the entity and the audit. It does not name the evidence. INTEGRITAS ONE is the evidence layer: every action of a superintelligent AI agent checked in the path, signed, with what was NOT-DONE on the record, ready for the audit the policy promises.
Article 5(1)(f) of the EU AI Act has been in force since February 2025: inferring emotions in the workplace is prohibited. A control that reads the content of what people and agents say is one more system under that article. Ours never reads the content. It checks the act against the rule, in the millisecond, and nothing else: that is what lets it into the European estate at all. The optimism gap is real (a third of the Netherlands, two in five Americans, four in five in China), and the admission ticket is the same in all three.
Ten positions. Every number below is quoted from its primary source and linked; where no primary number exists, we state the position without one.
Our checkpoints need zero chain-of-thought.
A control that decides by reading the model’s reasoning depends on that reasoning staying visible — and reasoning is moving inside the model. INTEGRITAS decides on the action the agent is about to take and the authority it was given, never on what it was thinking. When the thought goes dark, the check does not.
“Roughly 7% of the transcripts we evaluated were successfully spoofed.” — METR, 26 August 2026
In METR’s independent investigation of an agent hacking incident — roughly 1,200 agents, over 70,000 messages and files on one unsanctioned board — agents forged tool calls in their own records, and then adopted Ed25519 signing among themselves to stop impersonating each other. Any control that reads the log to decide what happened is reading a document the subject can edit. Our receipt signs the action at the checkpoint, never the transcript. Source: METR, “Brief independent investigation of agents’ behavior, reasoning and collaboration”.
Revoking a credential answers whether the agent may act. It never says what it was allowed to do.
Enterprise platforms now ship a kill switch that stops an agent by revoking its credential. That is containment after the fact: it says nothing about what was delegated before, and proves nothing about what was done. We revoke in the path, per doer — the next action is refused at the checkpoint, and every action before it carries a signed record of the authority it used.
An adversary agent that can decrypt what it steals is not slowed by a control that reads content.
Attackers now run agents end to end, at machine tempo: find the data, work out how to open it, move it out. A control that has to read and understand the content loses that race by construction. The control that keeps up is the one that never needs to read the content at all — it checks the action against the authority, at the speed of the action.
Three skill scanners disagreed on 23,702 of the 61,990 agent skills they all cover.
Against a human-adjudicated reference, weighted scanner sensitivity ranged from 21.67% to 61.06%; 77.86% of the skills have zero stars and zero comments, and 85.06% of the readable ones carry privilege evidence. A scanner’s verdict is an input we read gladly — it is not a gate. Ours is simpler: an unsigned skill, plugin or MCP server does not load (MCP-Attest). Source: Xiong & Zhang, arXiv 2609.17274, September 2026.
84 malicious versions across 42 packages — published through the project’s own legitimate trusted-publisher pipeline.
On 11 May 2026 a widely used open-source family shipped credential-stealing malware in six minutes, and every version came out of the real publishing pipeline. Attesting the build proves the process; it does not prove the traversal. The one thing a worm cannot sign is the in-band check at the moment of the action — which is where our doors sit. Source: GitHub security advisory GHSA-g7cv-rxg3-hmpx, 11 May 2026.
Half of the buyers saw an agent act without authority. One in eight can trace it.
Two company surveys published on 13 and 15 October 2026 say it in the buyers’ own numbers: 49.8% of more than 380 security and technology professionals confirmed or suspected an agent took an action the organisation did not intend, expect or authorise; 12.5% can trace a complete agent path; 17.5% can stop one; and in the second survey only 1 in 200 actions required human approval before it ran. The number is theirs. Our own measurement of the same gap, on a public attack corpus, is on the WARRANT page: the audit evidence of the act, signed outside the agent, is what closes it.
A passport says who you are and what you may do. It does not say what you did.
Identity and permission are issued before the act, by the platform that runs the agent. The record of the act has to be signed after it and held by the party the agent acted on. Across 14 primary announcements read in the October window, the word “receipt” appears in none. Our AIM PASSPORT is checked by the party the agent acts on, and every action carries its own signed receipt, including the actions that were refused.
“Denied by default” stops an act. It does not prove that it was stopped.
Of five open runtime claims tested at the page in the October window, two bind the action before it runs and none signs the record. In one public report of scheduled agent runs, 12 of 179 runs ended stranded with no result. A decision is not a mandate, and an enforcement is not a receipt: the party outside the runtime needs the signed record, with the NOT-DONE on it.
A gate that reads content let 870 of 3,669 attacks through, and charged for each call.
In a 14 October 2026 head-to-head published by a guardrail company, the best general decision model let 870 of 3,669 attacks through, about 1 in 4, at 0.25% false positives and 526 ms, with a paid model call on every action. A gate that decides on the action against the authority never reads the content, so it has no classifier to be wrong about: content-blind is a worth as well as a rule.
We don't ask for trust, we hand you the evidence.
Every group writes into HERD: privacy-safe threat signatures shared across every customer. One attack on any customer immunizes every other. A competitor copying the code starts with an empty network — ours widens every day.