Track
Talk to us Design a pilot

See every agent. Stop dangerous actions before they run.

Track maps every agent and everything it can reach, detects risk inside each action, and prevents unsafe behavior inline before execution.

Design a pilot See the estate map
Checkpoint · simulated feed Decided 0 Denied 0 Held 0 Restricted 0
    Governs agents built on
    • Claude Code
    • Codex
    • ChatGPT
    • Microsoft Copilot
    • Cursor
    • Openclaw
    • Any MCP client
    1. 01DiscoverThe full agent estate, reconciled from the sources you already trust.
    2. 02DetectRisk inside the payload: injection, PII, secrets, destinations.
    3. 03PreventYour policy, enforced on the action path before execution.
    4. 04ProveA signed receipt for every decision, verifiable offline.

    01Discovery

    Build the map others miss.

    Being able to reach a service is not permission to use it.

    Most teams can name the agents they approved. Few can name the ones running on developer laptops, inside CI, or behind a vendor's OAuth grant, or say what each one can actually write to. Track joins seven independent sources into one estate map, and every finding carries the evidence that produced it.

    Fig. 1.1   Read

    Seven sources. Nothing installed on the agent.

    Identity provider, OAuth grants, cloud IAM, CI/CD, repositories, MCP configs on developer endpoints, and live traffic through the checkpoint. Paths hashed, secret values never read.

    Fig. 1.2   Reconcile

    Thirty-five records become one graph.

    Each record is evidence about an agent, the identity it borrows, the tools it holds, or what those tools can touch. Reconciled, they become paths you can follow end to end.

    Fig. 1.3   Expose

    Reach, not permission.

    Three of six paths end at something nobody meant to hand an agent: a production write, a tenant-wide send, a bulk export. Each one arrives with the sources that prove it.

    Fig. 1.4   Estate explorer · illustrative estate

    Fig. 1.5   What the map surfaces

    • UngovernedAgents with no checkpoint

      Running and reaching real systems, with no policy in their path. Found on endpoints, in CI, and in vendor grants.

    • Shadow MCPServers nobody registered

      MCP servers configured on developer machines that carry write-capable credentials to production.

    • Over-privilegedInherited reach

      An agent should not inherit every permission the machine it runs on happens to have.

    • DelegationChains of borrowed authority

      Agent calls agent calls tool. Track follows the chain to the identity that actually holds the grant.

    • NewSurfaces that just appeared

      A new OAuth consent, a new tool, a new write path. Flagged with its source the day it shows up.

    • StaleAccess that outlived its use

      No traffic for weeks, credential still valid. The cheapest risk to remove.

    → Every finding has a route to protection. Track drafts the rule that would govern it; a person decides whether it ships.

    How policy gets written

    02Detection & enforcement

    A signal is not a decision. A rule you wrote is.

    The model never decides its own permissions.

    Every call an agent makes is turned into one typed action, inspected for risk, and checked against policy you own. The outcome is deterministic, it happens before the downstream system sees the request, and it is the same every time the same action arrives.

    Fig. 2.0   Try it · four sliders, one uncomfortable number

    A detector that catches 99% of attacks and flags 1% of harmless calls sounds excellent. Move the sliders and see how many of its alerts are real.

    Alerts that are real attacks

    1%

    Alerts per day
    Real attacks among them
    Real attackFalse alarm

    → This is why a finding never blocks work on its own in Track. Detection feeds a rule scoped to identity, tool, resource, and payload, and the rule decides.

    Fig. 2.1   Policy console · illustrative policy, syntax simplified

    Request intercepted

    
            
    

            
    
              
    policies/agents.yaml signed · v22
    
              
      
            
      

            
      
              
      Evaluation 0.9 ms
      
              
        
              
        
                Verdict
                DENY
                
        
              
        
            
        
          
        
        
        

        
        
        
          
        Fig. 2.2   Four outcomes, decided before execution
        
          
          
            
        1. ALLOW
          Runs with a one-time execution token bound to the exact payload. A modified request is a different request.
          2. 
            
        2. DENY
          Never reaches the resource. No execution token is issued, and the agent gets a reason it can act on.
          3. 
            
        3. RESTRICT
          Runs narrowed: fewer rows, masked fields, a tighter resource prefix. Useful work continues inside safe bounds.
          4. 
            
        4. HOLD
          Pauses for a named person to approve the exact payload. Approval is bound to what runs, not to what was described.
          5. 
          
        
        
        

        
        
        
          
        
            
        Anything an agent reads can contain an instruction.
        
            
        Parallel inspectors analyze each payload before policy runs. Encoded content is decoded and inspected again, so evasion does not become a free pass. Findings become inputs to your rules; they never make the decision on their own.
        
          
        
          
          
            
        • Prompt injectioninbound + outbound
          • 
            
        • Command & SQL injectiontyped arguments
          • 
            
        • Path traversal · SSRFinternal + metadata hosts
          • 
            
        • PII in payloadschema-aware
          • 
            
        • Secrets & credentialskeys · tokens · passwords
          • 
            
        • Encoding evasionbase64 · hex · url, reinspected
          • 
            
        • Unapproved destinationsdomain allowlists
          • 
          
        
        
        

        
        
        
          
        
            
        Session
        
            
        Stop the sequence, not one request.
        
            
        Sessions are scoped by allowed tools and resource prefixes. A trust failure can force approval on everything that follows, revoke linked execution tokens, and quarantine the session.
        
          
        
          
        
            
        Output
        
            
        Defend the output boundary.
        
            
        Spotlight untrusted tool output, neutralize image-beacon exfiltration, apply domain allowlists and output caps, and quarantine on breach.
        
          
        
          
        
            
        Direction
        
            
        Both ways through the gate.
        
            
        Inbound and outbound inspection on one policy surface: what a tool returns to the agent is checked with the same rules as what the agent sends out.
        
          
        
        
        

        
        
        
          
        
            
        Where policy comes from
        
            
        Drafted by Track. Promoted by a person.
        
            
        Day one starts without rules. Autodraft turns the discovered estate and the traffic Track has already seen into reviewable draft policy, from a fixed library of templates. No model writes a rule, and no draft deploys itself.
        
          
        
          
          
            
        1. AGap mapSurfaces in the estate with no rule covering them
          2. 
            
        2. BDraftDeterministic templates: the same estate drafts the same rules
          3. 
            
        3. CReplayRun the draft over recorded traffic and see every decision it would change
          4. 
            
        4. DPromoteA named reviewer signs it in. Rejected drafts are remembered
          5. 
            
        5. EEnforceLive on the next action. Drafts can never soften what you shipped
          6. 
          
        
        
        

        
        
        
          
        
            
        Getting it in the path
        
            
        No SDK. No code change.
        
            
        Point the agent's MCP config at Track. Same agent, same server: only the path between them changes. MCP, HTTP, shell, GitHub, and custom calls are normalized into one typed action on one policy surface.
        
            
        Self-hosted, single-tenant. Your cloud, your keys.
        
          
        
          
        // .mcp.json
{
  "mcpServers": {
    "github": {
-     "url": "https://api.github.example/mcp"
+     "url": "https://track.internal/mcp/github"
    }
  }
}
        
        
        
      
        
    
        

    
    
        
      
        
        
        
          
        03Proof
        
          
        A log tells you what it saw. A receipt proves what ran.
        
          
        
            
        Every Track receipt binds the exact request, decision, approval, policy version, and execution result into portable evidence. Allows too, not just blocks. Verify it offline with Track switched off, and keep it if you stop being a customer.
        
            See receipt anatomy 
          
        
        
        

        
        
          
        
            Agent action receipt
            rcpt_8F2A…91C0
          
        
          
        
            
        Action
        payments.wire_transfer
        
            
        Principal
        finance-agent.prod
        
            
        Policy
        FIN-WIRE-HOLD · agents.yaml@v22
        
            
        Approval
        group:treasury · 1 of 1
        
            
        Payload digest
        sha256:9f3a…21bc
        
            
        Executed digest
        sha256:9f3a…21bc MATCH
        
          
        
          
        
            VERIFIED
            Ed25519 · chain intact · independently checkable
          
        
        
        
      
        
    
        

    
    
        
      
        In the path before execution. On the record after it.
        
      
          
        
        1. 01Track discovers
          The agent, identity, tools, and reachable resources join the living estate map.
          2. 
        
        2. 02Track detects
          Risk inspectors analyze the request and its encoded content before policy runs.
          3. 
        
        3. 03Track prevents
          Policy allows, denies, restricts, or pauses the exact action before execution.
          4. 
        
        4. 04Receipt proves
          A signed record captures what was requested, decided, approved, and run.
          5. 
      
        
    
        

    
    
        
      
      
      
        
        
        Start with one real workflow
        
        
        Map one real workflow. Stop one real risk.
        
        
        We’ll discover its reachability, run your actions through the defense path, and produce signed receipts in your environment.
        
        
        
          Design a pilot 
          contact@tracksec.io