Research
Tools and analysis to track emerging technology, adoption, and risk. None of it is for sale.
mcprisk
Evaluation and risk scoring for MCP servers
MCP servers give AI agents their tools, and most were built with little thought to what a bad one can do. mcprisk scores any MCP server against a published security policy: provenance, permissions, transport and auth, known vulnerabilities, and whether the description matches the code.
The scoring method is open, so you can check or challenge any result.
Signal Scout
Data-driven mapping of the AI software ecosystem
Signal Scout maps the AI ecosystem from real ground truth data, classifying 50,809 public repositories by framework, MCP server, and security practice. It surfaces trends, risks, and deployment patterns you would otherwise have to scan for yourself.
StableScope
Stablecoin registry and real-time operational risk monitoring
A registry and freeze monitor for blockchain stablecoins. Still early and rough in places. It exists to make one thing concrete: how much control issuers keep over money that is described as decentralized.
Agent threat model
An interactive threat model for AI agents
Set up your agent in six steps, from containment and runtime through to adversarial inputs. The diagram then shows what a compromised agent could reach and which controls close each path. Exports to SVG or PNG for a deck or a policy document. Beta.
Writing
Analysis of security, AI, blockchain, and emerging technology risk
Deep dives on security and AI risk. The pieces below are published here, and the full archive is on Medium.
- The security program baseline: 54 tiered requirements
- What we found scanning 1,480 MCP servers
- A visual guide to enterprise AI risk
- What belongs in an AI agent security policy
- How to choose AI security tooling for your risk profile
- Choosing an LLM: cost, capability, and sovereignty risk
- Fractional CISO vs. full-time: when each one makes sense
- What slows down a SOC 2 audit
- A risk assessment framework for stablecoins and crypto treasuries
- A security checklist for on-chain treasury and multisig setups
Contact
What we learn here goes straight into the security work. If you want that applied to your own systems, get in touch.