Unveilr
Govern the AI that writes, ships, and runs your code.
The control plane for AI-agent actions — Discover · Guard · Govern · Prove.
Your teams are shipping AI-written code and wiring up AI agents faster than security can review them. Agents are software artifacts now — they have code, prompts, tools, permissions, owners, versions, environments, and blast radius. Unveilr treats them as first-class citizens of the SDLC: it discovers every AI in your estate, guards risk before it ships, governs what agents do at runtime, and proves it's all under control — from a developer's terminal to the console your CISO watches.
For a concise value map by role, start with Why Unveilr.
Why Unveilr is different: the map vs. the gate
An AI-BOM describes your AI stack — components, lineage, prompts, agents. It never decides whether a live action is still allowed to execute. That's the missing layer, and it's the one we build.
Unveilr licenses the gate, not just the map. The gate:
- Checks admissibility at commit — at the PR that creates an agent (Guard), and at every tool call it makes at runtime (Govern).
- Fails closed when conditions break — an unapproved server, a drifted tool definition, an invalid schema, or a denied policy is refused, not forwarded. (Structural gates stay hard in every mode; policy enforcement is a mode you turn on after Monitor Mode proves it right.)
- Emits proof — a tamper-evident record of what was allowed, refused, or halted.
They guess at the map. We license the gate.
How it fits together
One product, two surfaces: authoring-time (the code AI writes) and runtime (the agents AI runs). Both feed one control plane — findings, blast-radius, evidence, and compliance.
Console path: / (Overview)
Capture: full first viewport with KPIs + recent activity.
Also capture: /onboarding (Get started checklist) for “time-to-value.”
The mental model: Discover → Guard → Govern → Prove
| Pillar | What it does | Where you use it |
|---|---|---|
| Discover | Inventory every AI tool, agent, MCP server, model, prompt, API key, cloud AI service, and dependency — your AI Bill of Materials (AI-BOM) — plus shadow AI. Agents are rich, linked artifacts (code · prompts · tools · permissions · owner · version · env · blast-radius). | CLI scan, Console → AI Inventory & Identity Graph |
| Guard | Catch AI-written risk in the editor / PR / CI: unsafe AI code, secrets, broad IAM, shadow MCP, risky agent config, new tool permissions. | CLI, VS Code extension, GitHub Action |
| Govern | The agent deployment gate (register → owner → approval → scoped credential) plus the Agent Gateway, which enforces policy on every MCP/tool call: allow · deny · require-approval · step-up · redact · sanitize · rate-limit · agent tool scope. | Console → Agents · Registry · Policies · Approvals · Sessions |
| Prove | Tamper-evident evidence of what existed, changed, was blocked/approved, and what agents did — mapped to 11 frameworks, with human attestation per control. | Console → Findings, Evidence & Compliance |
See What Unveilr detects for the full detection reference (secrets, PII, prompt/tool injection, IaC, shadow AI, slopsquatted deps) with examples.
Guiding principles
- Monitor Mode first. Everything can run in observe mode — it reports but never blocks — so you roll out safely, watch it be right, then enforce.
- Offline & reproducible. The scanner makes no network calls and gives the same result every run. Your source never leaves the machine unless you upload.
- Meet AI where it's created. In the IDE (via the CLI), in the PR, in CI, in the cloud, and at the agent's tool call.
- Developer experience is a feature. Install in one line, scan in one command, upload when ready — see Developer experience.
Who uses what
| Role | Value |
|---|---|
| Developer | unveilr scan in the terminal / IDE; PR checks that judge only what a change introduces; inline Problems-panel findings. |
| AppSec / DevSecOps | The AI-BOM, findings triage, blast-radius prioritization, and PR/CI gates across every repo. |
| CISO / AI governance | Org-wide Shadow-AI inventory, provider usage, attested compliance packs, tamper-evident evidence. |
| Platform / Agent teams | Agent registry + runtime Gateway that governs MCP/tool calls with scoped credentials. |
Next
- Why Unveilr — outcomes and added value by role.
- Trust Center — verifiable claims and honest SOC 2 status.
- Quick start — your first scan in 5 minutes.
- Console operators — day-two console walkthrough.
- Production APIs — hosted URLs, auth, and every persona.
- Developer experience — CLI, IDE, CI, login, tokens.
- Integrating within your company — CI/CD, GitHub, cloud, agents, self-host.
- Screenshot guide — recommended console captures for documentation.