AI Security
As teams adopt LLMs, agents and AI-assisted coding, a new attack surface arrives with them: models and SDKs pulled in as dependencies, agent instruction files that can be poisoned, MCP tools wired to external services, and AI-suggested packages that do not exist yet. apPosture treats all of this as first-class security posture, not an afterthought.
The suite has four parts, all proof-based and all running inside your own infrastructure:
| Capability | What it answers | Where |
|---|---|---|
| AI-BOM | Which of our apps use AI, and which models, agent frameworks and vector stores do they pull in? | /assets/ai-bom |
| AI config scan | Is an AI assistant's rules file poisoned - told to exfiltrate secrets, disable a control, or pull a specific package? | Runs on every repo / CI scan |
| MCP governance | Is an AI agent wired to a remote MCP tool surface nobody reviewed? | Part of the AI config scan |
| Slopsquat detection | Did an AI recommend a package that does not exist, or was published days ago? | Part of SCA |
apPosture also provides context to your AI dev tools through its own read-only MCP server - so an assistant can query your posture without ever gaining write access.
None of this requires sending your code or prompts to a vendor. The AI-BOM is a lens over dependencies you have already scanned, and the config and slopsquat checks are pattern- and registry-based - they run locally.