Security

Shield KYA

A local ledger of every tool call your coding agents make

If an agent in your repo ran a destructive command last Tuesday, this is the cheapest way to learn which one, when, and whether policy allowed it.

Kairos

Real-time fraud decisions for sign-ups, payments and payouts, self-hosted

An Apache-2.0 alternative to Sift and Sardine that returns approve, step-up, review or block with reasons, and lets coding agents build the workflows.

LokaDB

Postgres proxy that moves one tenant's rows into a database they own

When an enterprise prospect insists their data stay on their own Postgres, this answers with a connection-string change instead of a rewrite.

leanrea

A tiny agent skill that points it at the right reverse-engineering command

If your coding agent pokes at binaries, a single small file of tool advice can cut run time and spend without standing up another MCP server.

Before you let an MCP server near your agent, this tells you whether it reaches for a host its README never names, and which of its tools go undocumented.

Weir

Plant fake API keys, then find out where your agent sent them

It catches the kind of leak you cannot grep for, a key copied into a trace, a log or the model's own context, and names where it went without printing it.

Bouncer

A local gate on where your agent is allowed to send things

It assumes the injection already worked and narrows the damage to recipients the agent did not read somewhere, which is a different bet from detection.

dontallow

A launchd agent that answers the local network prompt so you stop seeing it

If Sequoia keeps asking the same question every time Chrome updates, this presses the refusing button for you, and the price is handing a small unsandboxed binary your Accessibility permission.

ESP-Watchtower

Turns a spare ESP8266 into a network watchdog with three decoys

For the price of a sandwich you get a device that records who knocks on your LAN and how long your internet was really down, with nothing leaving the house but a Discord message.

PatchAndShip Check

A free key-leak scan for the app you shipped without reading the headers

It reads only your homepage, up to ten JavaScript files and your response headers, so it costs nothing, needs no account, and cannot reach your database to break anything.

MediaForge

Clean location and device data out of photos and videos before they leave you

For a small product that serves user images, it is a privacy step and a cheap CDN in one, priced well below the usual image platforms.

monkeys

Secrets stay in your OS keychain; the repo records only the key names

If coding agents run in your repo, monkeys lets them use API keys through a redacted runner without ever reading the values themselves.

Rouler

Split tunnelling for Windows: decide which network each app or address uses

Windows has no clean way to run Tailscale, Mullvad and a work VPN side by side; this gives each app its own route without touching the route table.

Clotr

Catches passwords, card numbers and IDs before they reach ChatGPT or Claude

If your team pastes into AI chats all day, this is a free, local check that stops a password or customer's card number leaving the building by accident.

CallSitter

A voice agent that picks up your phone, sorts the caller and keeps scammers busy

It shows a working pattern for a voice agent whose behaviour is steered by a separate classifier and a fixed call flow, not by the prompt alone.

Carrier-Explode

What each carrier pushes to iPhone, Pixel and Galaxy, decoded and diffable

When a phone loses hotspot or Wi-Fi Calling on one network, this shows the carrier config that caused it, build by build, instead of leaving you to guess.

Clova

Give each company its own address; anyone else who writes to it is bounced

When a shop sells or leaks your address, mail from anyone but that shop bounces, so you know exactly who leaked it and lose nothing by deleting the inbox.

OpenRod

Give each coding agent its own VM and its own network policy

If you let an agent run commands unattended, this is the cheapest way to bound what it can reach and keep a record of what it did in there.

MCP Transparency Log

A signed, append-only daily log of what public MCP servers say their tools do

If your agents call third-party MCP servers, this shows how often their tool descriptions quietly change under you, with proof.

Jotbus

Let Claude Code, Codex and Cursor hand work to each other without you relaying

If you run two coding agents on one task, this removes you as the copy-paste courier between them, and the server never sees the plaintext.

Borehole

Reads a codebase's commits for the risks an acquirer would find, with citations

Founders preparing to sell can see what a buyer's engineers will flag months before diligence, free for any public repo.

iwrote

A writing page that keeps a tamper-evident log of how each piece was typed

Instead of guessing with an AI detector, a writer can hand readers a checkable record of pauses, deletions and pastes.

Aartool

Linux hardening ranked by which attack paths each fix breaks, then verified

Instead of a flat list of CIS failures, a small ops team gets an ordered plan of what to fix first and evidence that the hardening changed only what it meant to.

BlindFlag

Two people compare dealbreakers and learn only where they clash

It turns an awkward early conversation into a private check where neither partner sees the other's answers, only whether they collide.