Inventory you did not have
Every machine, agent, MCP server and version your developers run, which credentials each one is given, and who runs it, reported by the guard itself. Not a survey; a live table.
Your engineers are running third-party code with their tokens inside it, on machines you cannot see.
Every MCP server a coding agent launches is a process on a developer's laptop with that developer's GitHub, cloud and database credentials in its environment. Gateways do not see it; scanners read it once. KillerSkills puts a guard on the process itself, on every machine, and gives the security team inventory, control and evidence.
Credentials that never reach the server
Under the guard the server holds a placeholder. The real value is injected only into requests to the vendor's own host, read from the package's code. With exchange rules, a scoped token minted per launch and revoked at exit replaces the long-lived one entirely.
Drift from the org's own baseline
The first time a version reaches a host that neither its verdict, its code nor any earlier session in your organization named, the developer is told and you get the alert, in Slack and in your SIEM.
A kill switch that reaches the fleet
Revoke a version from the dashboard and every guard refuses to launch it at its next start, with the reason. KillerSkills revokes network-wide when the honeypot confirms an incident; your organization revokes for itself.
Control over what agents may do
Policy rules per tool: allow, deny, or hold for a human decision in Slack. The agent sees the answer as the tool's reply; later calls queue behind it in order. Destructive verbs are held by default.
Evidence, streamed
Hash-chained audit log of every decision and change, CSV/JSONL export, access review packs that support SOC 2 and ISO 27001 evidence gathering, and every record and alert delivered to Splunk, Datadog or any HTTPS collector as it happens.
Deployment
- An admin creates the organization, sets the policy (minimum score, Caution action, the
runtime:clause: network, new host, credentials, flagged versions, tool rules, exchange rules) and turns on required-guard mode. - The enrollment script goes out by MDM or by hand: it installs the CLI, registers the hooks for Claude Code, Cursor, Codex, Windsurf and Gemini CLI, joins the org and puts every stdio MCP server under the guard. Originals are kept;
vet-skills guard uninstallreverses it. - From the first launch, sessions appear on the Runtime page; the baseline builds from the org's own traffic; Slack and the SIEM receive alerts; approvers decide held tool calls from Slack.
- SSO (Okta, Google, Entra) for the dashboard, roles owner / admin / approver / developer, per-team policies, retention you set.
curl -fsSL https://killerskills.ai/app/<org>/enroll.sh | KS_ENROLL_TOKEN=ks_org_… bash # installs vet-skills · hook install all · join <org> · guard install
Security and data handling
- What we store
- Package names, versions, hashes; hosts contacted; tool names and argument key names; which credential variables were brokered or exchanged; decisions, approvals, audit records. Never code, prompts, file contents or credential values.
- What we never receive
- Credential values. The broker and the exchange run on the developer's machine; the dashboard sees that GITHUB_TOKEN was brokered to api.github.com, not what it was.
- Hosting
- Railway (US), Postgres with encryption at rest, TLS in transit. Verdict attestations are signed (Ed25519) and verifiable offline.
- Subprocessors
- Railway (hosting), Stripe (billing), Resend (email), Slack (your webhook), your SIEM (your endpoint).
- Retention
- Runtime sessions and deviations: set by you (30–3650 days). Audit log: never pruned. Server error logs: 30 days.
- Access
- SSO for the dashboard; roles; every admin action in the hash-chained audit log; agent tokens hashed at rest and revocable per machine.
- Assurance
- Engine independently validated (Nov 2026, published). Security questionnaire answered in full; DPA on request; third-party penetration test commissioned before the first enterprise contract closes. No SOC 2 report yet, said plainly.
- Open source
- The CLI (the guard, the broker, the exchange, the hooks) is public at github.com/cyligence-karim/vet-skills under MIT, so what runs on your machines can be read.
Questions a security team asks
What exactly leaves a developer's machine?
Package names, versions and hashes; the hosts a guarded server contacted; tool names and the names of their arguments (never values); which credential variables were brokered or exchanged (never values); policy decisions. No code, prompts, file contents or credentials. The list is in the docs under “What leaves your machine”, and the CLI is open source so it can be checked.
Where does a real credential go under the guard?
Nowhere new. The server's environment holds a placeholder. The real value stays in the guard process on the developer's machine and is written only into requests to the host the policy binds it to. With an exchange rule, the long-lived value is not even used: a scoped token that lives minutes is minted per launch and revoked at exit. KillerSkills never receives credential values.
How fast does a revocation reach the fleet?
Every guard asks the launch check before starting a server. A version you revoke from the Runtime page is refused at the next launch on every enrolled machine, typically within a minute; running processes are not killed, and the developer sees the reason on stderr.
Can we deploy it with MDM?
Yes. The enrollment script (Developers → Enrollment script) installs the CLI, registers the agent hooks, joins the org and, in required-guard mode, puts every stdio MCP server under the guard. Machines that report without the guard install it at their next sync and show as non-compliant until they do.
What is the audit story?
Every decision, approval, policy publish, revocation and enrollment is a hash-chained audit record, exportable as CSV/JSONL, plus access review packs: date-bounded bundles of what was listed, observed, approved and attested, kept separate, with deterministic review items, reviewer dispositions and an acknowledgment bound to the records' hash. They support evidence gathering for your SOC 2 or ISO 27001 process; they are not a certification. Enterprise streams every record and alert to your SIEM as it happens (Splunk HEC, Datadog, CEF or JSON).
Do you have a SOC 2 report?
Not yet. We answer security questionnaires in full, provide a DPA and the subprocessor list, and will commission an independent penetration test before the first enterprise contract closes. The detection engine itself was independently validated in November 2026 and the findings are published on the blog.
What does it cost?
Per developer seat, annual, with an agent-count minimum; CI runners are never a seat. Design-partner pilots: 60 days, free, for three security teams in exchange for weekly calls and a reference. Ask for a quote with your seat count.
Pricing is per developer seat, annual, with an agent minimum; see pricing. Three design-partner pilots are open: 60 days, free, weekly calls, a reference at the end. [email protected].