Eleven tours, one platform. Every tour follows a product from input to proof — what goes in, what it does, what comes out. Nine run today with design partners; two are in build, and say so.
Available now
PR Review & Auto-Fix
Security review that ends in a merge-ready patch, not another ticket. Follow one pull request from the moment it lands to a verified, evidenced close.
Vulnerability Curation
Five scanners, one weakness, one owner, one fix. Watch three alerts for the same CVE collapse into a single owned issue.
MCP Permission Scanner
Every MCP server reviewed like code — tools, permissions, description drift — before it holds production scope.
Agent Identity Provisioning
Identity at creation, not discovered after the incident. Every agent is born with a named owner, scoped tools, an expiry, and a kill switch.
AI Governance Fleet
AI governance that produces remediation. Referee inventories your AI systems, tiers their risk, maps the controls — and sends the gaps out as fixes, not register entries.
Compliance Evidence Pack
One approved fix testifies four times. Dossier turns verified closures into auditor-ready evidence — collected once, mapped across frameworks, signed.
Agent Behavior Baselining
Know the normal path. Surface the meaningful deviation. Temperament learns how an agent usually behaves — then reasons about every step off that path.
Adversarial AI Red-Teaming
Exercise the agent configuration before an attacker does. Sparring screens an agent's instructions, tools, and scope — and hands you the gap list, signed.
Controls & Tool Posture
It checks your security setup for gaps. GapCheck reads the posture of the tools you already run and hands you the ranked list of what's missing — and what drifted.
In build
Agent Catalog
One catalog of every agent you run. Troupe registers each agent with its signed manifest, its owner, and its scope — so 'what agents do we have?' always has an answer.
Verified-State API & MCP
Ask the platform one question — 'is this control satisfied right now, and where's the proof?' — and get a signed answer, over API or MCP.