What you send
- MCP server definitions, or the tool schemas your agents load
- Agent configuration — which servers, tools, and scopes are reachable
- Optionally, a policy you already try to enforce by convention
Design partners
Run Provenant against your agent estate
We are looking for a small number of teams running MCP servers or tool-using agents in production. You send configurations, we run the detectors, you get findings and evidence back. Two weeks, no cost, no commitment.
What comes back
- Findings by severity, each with the evidence that triggered it
- Remediation steps written for the specific detector that fired
- Control coverage across NIST AI RMF, ISO/IEC 42001, and the OWASP lists
- A signed evidence record you can hand to an auditor
What we look for
Six attack classes, benchmarked before they ship
Every detector is measured against a versioned corpus of labeled attack and benign fixtures. The benchmark runs in continuous integration and fails the build when detection or false-positive rate regresses.
Tool poisoning
Instructions hidden in a tool description the model reads as direction
Invisible Unicode
Payloads concealed in zero-width and bidirectional characters
Cross-server shadowing
One server redefining another's tool to intercept calls
User concealment
Behavior written to be visible to the model but not the operator
Exfiltration
Tools that route arguments or context to somewhere they should not go
Secret solicitation
Descriptions that ask the model to supply credentials it holds
Where this actually is
Run by us, not by you — for now
The engine is real: fourteen detectors, benchmarked at full detection and zero false positives against a versioned corpus, with a signed evidence chain and a control crosswalk behind them. The control plane is deployed and the command-line gate runs in continuous integration today.
Self-serve onboarding is not built. For now a pilot means you send configurations and we run the analysis, rather than signing up and connecting a source yourself. That is a concierge engagement wearing a product's clothes, and you should know that before you spend time on it.
We are telling you because it is the same standard the product is built on. Provenant reports a control as unproven rather than claiming one it cannot evidence, and a company that would not apply that to its own maturity has no business selling it.
The exchange
What we ask in return
A design partnership only works if both sides get something they could not get alone.
Tell us what is wrong
A finding that misses, a false positive, a remediation step that does not fit how your team works. Negative findings are worth more to us than praise.
Let us learn from the shape
Not your content or secrets — the structural patterns. Real configurations are how the detector corpus grows past fixtures we wrote ourselves.
Say so publicly, if it earned it
A reference, only if the pilot warrants one. If it does not, we would rather know why than have a logo.
Three places, then we stop taking them.
A pilot is run by the people who built the engine, which is the reason it is useful and the reason there cannot be many of them.