Independently verify  and then reduce  the effective access and sensitive-data reach of every AI agent and MCP server you run.
Every metric traces back to evidence  what was granted, what was observed, and what the data classification says about it.
One posture number for your agent fleet, derived from reach, usage, and sensitivity  not from alert volume.
The share of modeled reachable resources each agent actually touched. Low utilization marks least-privilege candidates.
Resources holding PII, PHI, or payment data that an agent can reach  flagged before anything touches them.
Observed activity outside the modeled reach set, including external endpoints no policy predicted.
Permissions no observed run has exercised, prioritized for least-privilege review.
How much of your agent fleet is evidence-backed, so you know what the numbers do and don't cover.
Every edge states how it was derived.
Agents are discovered and ranked by risk with the non-human identity behind each one. Inventory entries are admitted on an evidence ladder  registry facts, structural facts, operator declarations, observed behavior. A name is never evidence.
Open any observed run as a Run Story: the causal chain from prompt to tool call to cloud API to resource touched  orchestrator-to-subagent delegation, denied reads, and credential hops included.
Agent Resource-Reach Utilization is the share of reachable resources an agent actually touched. Low utilization with high sensitive reach identifies a practical least-privilege opportunity: review access with no observed use.
One click exports the per-agent evidence  reach, usage, and sensitivity  in the shape your auditor asked for.
Agent-rooted, metro-map edges, semantic color: green is observed normal, yellow is first-seen, red is risky, blue is internet egress. Only sensor-observed traffic animates.
Issues are derived from the reach-and-usage join  not from signatures  and each carries its framework mapping and evidence.
Excessive agency and insecure tool integrations, grounded in observed reach
Agent-relevant techniques mapped to the evidence that triggered them
Measure and Manage functions backed by exportable, evidence-linked reports
An AI-rooted graph: pick an agent or MCP server and see who can access it, its open issues, and everything within its reach.
Changes worth attention  first-seen paths, shared credentials, unauthenticated MCP servers  each with evidence.
The non-human identities behind every agent, plus the workforce principals who can assume them.
Sensor, collector, and integration health, so you always know how fresh your evidence is.
The PyroTrace Sensor observes workload traffic at the kernel (eBPF, read-only). CloudTrail, MCP gateway, LLM telemetry, SIEM, and EDR imports corroborate it. Reach is modeled from live IAM policy  including the model layer: who can invoke, fine-tune, or read artifacts from Bedrock and SageMaker models.
Claims stay evidence-bounded: we record that agent-attributed traffic reached a classified resource, with bytes out. Payload content remains unverified, by design.
A guided walkthrough of the agent inventory, Data Reach, Agent Map, and the evidence behind each exposure finding.