Everything we do is that one comparison, at three levels. The agents you wrote down against the ones we observe. The authority an agent was granted against the behaviour it shows. The changes somebody declared against the ones that merely happened.Whatever sits in the gap is the finding, and it is a finding in dev, at the gate before you ship, and in production.
You maintain a list of the agents you know about. Agenor builds a second list from behaviour alone, out of telemetry you are already emitting, then reconciles them. An asset takes its kind from your declared roster, and an undeclared one is reported as a shadow rather than quietly typed. Every finding carries its app and its environment, so a shadow in dev reads differently from the same shadow in production, and neither is hidden from you. It is not only agents: tools, MCP servers, skills, identities and permissions are inventoried the same way, because that is where an agent's real reach comes from. Sources are first-class too, and a collector with no owner reads owner null, since an unowned source is a finding rather than a blank to fill with a default.
Most teams come in at rung one or two and stop there for a while, which is fine. Each rung is useful on its own and each is built on the same ingest, so moving up is a setting rather than a migration. The three product lanes are named beside each rung.
Every agent, tool and MCP server observed in your traces, what each one reached, and which of them never appeared on your roster. Read-only.
A scoped assessment against a candidate agent in dev or staging: detection over blast radius, crown-jewel reachability and attack paths, plus probes fired at it. You get an answer for security and for governance, and the unknowns are listed as unknowns rather than averaged into a number.
The same detection on a live stream, with incidents that dedupe, recur and carry ownership. Claim, assign, triage, escalate, suppress, accept risk, and push to Jira, ServiceNow, PagerDuty, Slack or a webhook.
Operators declare changes to a prompt, model, tool, MCP server, skill, identity, permission or configuration, with before and after versions and a stored diff. Agenor derives the other half from captured history. Both land on one timeline, which is what lets a declared change be told from one that merely happened. Approve or reject with a second pair of eyes, and drift is never treated as approval.
Evidence packs carrying a content hash, a versioned signer key, a validity window and a revocation URL, crosswalked to the frameworks you report against. A pack whose underlying claim is unsupported refuses to generate rather than attesting less.
In the action path: signed authority envelopes naming exact targets, versioned signed policy, a human queue behind every deferral, and kill or quarantine containment. Staged shadow, then monitor, then enforce, so nothing blocks on day one.
Every rung above is software you can run yourself. These two are the same capabilities delivered as work we do for you, on your estate. Each comes two ways, and the difference is not the size of the invoice: a one-off answers "where are we right now", and continuous answers "what changed since, and who changed it". Most teams buy one-off first, because it needs no platform decision, and move to continuous once the first report is already out of date. The compliance corpus is sold separately and is further down.
We point Agenor at your agents and come back with your estate, the shadows in it, what each agent can reach, and findings ranked by blast radius. Read-only throughout.
A battery fired at a candidate agent: prompt injection reaching a real action, tool poisoning, authority escalation, exfiltration paths. Every probe and its outcome recorded so the run can be repeated.
Vendors tend to add these together into one impressive number. They are different claims carrying different weight, and internally they are different evidence classes that cannot resolve each other's findings, so we keep them apart here too.
Detector families reading traces you already emit, with nothing fired at your agents. These run on live customer telemetry today.
Findings arrive as the security condition with its MITRE technique. The full detector catalogue goes to customers under NDA rather than onto this page.
A signed sweep over the tool manifests your agents are actually wired to, re-scanning the latest signature per agent and per MCP server on every pass.
A finding is held per server, so a clean scan of one never clears a problem on another. Skills, plugins, identities and permissions are tracked as declared and observed change, which is a weaker claim than scanning and is why it is worded differently.
A red-team battery run against a candidate agent, in dev or staging, at the gate before it ships.
We keep three separate counts internally: classes named, probes written, and probes wired into a battery that actually runs. They are not the same number and we will give you all three for your scope, in writing, before you buy anything. They are not on this page because the catalogue is the product.
A one-off assessment tells you the state of the estate on the day someone looked. The finding that keeps mattering is the gap between the authority an agent was granted and the behaviour it actually shows, because that gap opens quietly, between audits, as tools get added and scopes get widened. The distance from the diagonal is the finding. Drift shows up as geometry before it shows up as an incident.
Detection tells you an action happened. A record of granted authority tells you whether it was ever supposed to. Only the second survives the question"was that agent allowed to do that?", which is the question an auditor asks and the one a screenshot of a dashboard cannot answer.
Every agent now sits on the line. One key signed both the permission and the report of what happened, so the report can only agree with the permission. This is what a self-attested chart looks like, and it is why the system refuses to start in this configuration.
Agenor attaches to what you already run, and how much work that is depends entirely on where your agents live. You will not find a wall of logos here. A logo implies a tested integration, and we only claim that for platforms we have actually built a collector for. Everything else reaches us through the open telemetry convention, which is genuinely most things and is not the same promise. We will tell you which case you are in before you buy, rather than letting you find out on a call.
Including LangGraph and Claude Code: a packaged collector with its own test suite, shipped and exercised by us on every build. Ask about yours and we will tell you straight whether it is on this list.
Point an OTLP endpoint at us and agent spans arrive unchanged. This works by the open convention rather than by an integration we wrote, which means it usually works and we have not tested your platform specifically. We will say which case you are in.
An MCP gateway that needs no change to the agent. This is the layer that offers a decision, where the others offer a read, and it is also the one that can be routed around.
An action that skipped the gateway wrote no receipt, so the enforcer's own log is the one place a bypass can never appear. We detect it anyway, from evidence the enforcer does not control and cannot erase. How that works is something we will walk you through directly.
If you have an enforcing control in front of your agents, we can take a read-only tap on it and attest what it decided, rather than asking you to replace it. Telemetry tells us what an agent did; this tells us what a control decided about it. We operate none of it, which is the point.
Decision records from a gateway carry raw material, literal SQL and HTTP bodies included. That is dropped at ingest, before an event exists on our side, rather than filtered later by a reader. A filter downstream leaves the thing upstream still writing it.
Agenor both enforces and attests, which should void the attestation. It does not, because the two planes hold different keys in different trust roots, and the system refuses to startif anyone collapses them into one. That is also why our output survives leaving us: a pack verifies offline against a published keyring, so your auditor checks it without taking our word for anything, and without us in the room.
Signs evidence packs. Its verifier is the one your auditor or regulator runs.
Signs authority envelopes and decision receipts. Its own custody directory and pin.
Findings, case history, changes and decisions are append-only and hash-chained. The roles are split so the component being recorded is not the component that can rewrite the record.
The practical consequence: a correction appends a superseding record rather than editing the original, so the history of a finding survives being wrong about it. Nobody at Agenor can quietly revise what was recorded, us included.
The Protect lane answers "may this happen?" before it happens, at an MCP gateway that needs no change to the agent. Allow, deny or defer to a human, inside a 250ms deadline.
Every policy version carries its enforcement rung inside its own signature, so a version cannot be moved between rungs without the content hash moving. New versions default to shadow, which means nothing you publish starts by blocking traffic.
This one is not about your estate. It is a corpus, and it is built for agents specifically: the Model Context Protocol specification, agent authority and tool permissions, autonomy and human oversight, alongside the AI frameworks your auditor already names. Requirements extracted one by one with a source anchor each, dispositioned, and crosswalked to the detections that can evidence them. Delivered as a versioned, content-hashed pack and kept current as the frameworks move. You can license it on its own, with no assessment, no telemetry and no platform decision. It is not self-serve yet: scope and terms are agreed per buyer, so the next step is a conversation rather than a checkout.
Working material for an engagement. Requirement-level detail with a source anchor on every row, so a finding traces back to the clause it came from rather than to our summary of it, and a disposition saying whether evidence for it can be produced from a system at all.
Which agent governance obligations actually apply to you, split by what a machine can evidence and what a human has to attest, so the work can be assigned. Then kept current: a standard revises quietly and your mapping is wrong from that morning, with nothing to tell you.
A content and intelligence feed you license for your own product. Map your coverage to the frameworks your customers ask about without building and maintaining the extraction pipeline yourself, which is a standing cost rather than a project.
Twelve carry crosswalk records, proposing a canonical reference so one control can answer several frameworks at once. The thirteenth, the MCP specification, is extracted but not yet crosswalked. A crosswalk is a proposed equivalence with a confidence and a reason attached, not a detection claim.
The five deepest of the thirteen, 857 of the 951, extracted requirement by requirement with a source anchor each. The twelve beside it is the mapping surface; these five are how deep the extraction has gone. They are different numbers because they measure different things.
You can scope the engagement yourself in a few minutes, including for an agent you can only reach over the network and cannot instrument, and the credential we ask for is scoped to that one job. Getting from there to a first finding is still a run we do with you rather than one you kick off alone; the hands-off path is being built and is not finished.
Access is approved by us rather than open signup, which is deliberate while the estate is small, and we would rather say that than dress a waiting list as a product tour. Prefer it done for you? That is the assessment above. Ongoing work is banded by agents in scope andnever billed per finding, because a grader paid by the finding is not a grader.