See what your agents are allowed to do.
Serpio Atlas is a living map of the agents, tools, MCP servers, identities, data paths, and native binaries in a system. Findings are paths on that map, and every paid engagement produces one for the system we reviewed.
One node per surface in scope.
Who may call what, what loads, what identity is bound, what data is reachable.
Concrete paths, each rated and backed by evidence.
The map of the reviewed system, plus findings and evidence your team can replay.
Eight surfaces, and which can act on which.
Prompt firewalls watch text and cloud posture tools watch infrastructure. Atlas records what each agent may call and reach, down to binaries that ship without source, and attaches findings and evidence to those paths.
| Surface | Kind | Reaches |
|---|---|---|
| User | principal | Agent |
| LLM | model | Agent |
| Agent | runtime | LLM, Tool, MCP server, Identity, Native binary |
| Identity | authority | Agent, MCP server, Data path |
| Tool | action | Native binary, Data path |
| MCP server | broker | Identity, Data path |
| Native binary | opaque | Data path |
| Data path | data | Native binary |
Five findings, plotted on the surfaces they live on.
Each finding is a class we test for, mapped to the surfaces that carry it, so you can check your own system for the same class.
Showing 5 of 5 classes.
| ID | Severity | Class | Surfaces |
|---|---|---|---|
| LLM01 | High | Prompt injection past your filters Instructions arrive inside content you already trust: a document, a page, a tool result. | User, LLM |
| AG1 | High | Agents steered into unsafe tool use A persuaded model uses the real credentials it already holds. | Agent, Tool |
| AG2 | High | Authority boundaries that leak One component acts with the privileges of another, and nothing in the flow says no. | Identity, MCP Server |
| SC1 | Medium | Model and weight provenance Weights, adapters, and datasets arrive with no chain of custody you can prove. | Data path |
| RE1 | Medium | Risk that sits past source Firmware and binaries ship behavior that no source review sees. | Native Binary |
In an engagement, the surfaces each class touches are measured on your system; see the threat register and the method page.
Five states, and what each one proves.
Each cell on the map holds exactly one of five states, which record the work done on that surface so far. Each surface shows a strip of five cells, and the map readout counts them.
Currently 9 unmapped, 6 mapped, 5 tested, 14 hardened, 6 retested across 40 cells.
| State | What it claims | Held by |
|---|---|---|
| unmapped | Known to exist; nothing about it has been read yet. | User, LLM, Native Binary, Data path |
| mapped | In Atlas and reachable from a known entry point; not yet attacked. | User, LLM, Native Binary, Data path |
| tested | Attacked inside the agreed window. | User, LLM, Native Binary, Data path |
| hardened | Controls changed after testing. | Agent, Identity, MCP Server |
| retested | The original attack re-run after the change, and it no longer works. | Identity, Tool |
The method page defines each state, the severity rubric, and the six phases that move a surface from one state to the next.
One path, hop by hop.
A finding records how far a compromised path could already reach, written as the chain of hops that carried it. The map stores the whole chain, so a fix can target the hop that granted the access. Remove the gate below to see where the request ends up.
- Entry
Content the agent already trusts
A document, a page, a tool result, or a message another agent wrote. The instruction arrives inside something already believed.
Hop 1 · LLM01 lives here · User → Agent → LLM
- Reach
The tools it may call
Read-only or write scope, and the identity each call runs under. Permissions are recorded for each tool.
Hop 2 · AG1 lives here · Agent → Tool, Agent → MCP server
- Data
What that identity can touch
Named datastores, and where the reach crosses a tenant, a team, or a trust zone it was not meant to cross.
Hop 3 · AG2 and SC1 live here · Identity → Data path, MCP server → Data path
- Gate
A human, on anything that acts
A destructive or client-visible step stops for a named operator before it runs. Every high-impact step passes one.
Hop 4 · held · the path stops here until a named operator approves it
- Past source
The binary on the path
Vendor and native components that carry the call but ship without source. We read that hop by reverse engineering.
Hop 5 · RE1 lives here · Tool → Native binary
- Finding
The chain, rated with evidence
Impact, exploitability, and the permissions the path held, with replay steps. Each fix attaches to one hop, so closing the finding points to a specific change.
Rating · the whole chain, with evidence
Held at the gate, then closed by retest.
The write stopped for a named operator, the hop was rebuilt with scoped, short-lived credentials, and the same path was re-run until it no longer reached the data. The finding closes on that re-run, once the path itself has changed.
Outcome · contained, then retested
Catches this branch: Rebuild and harden, verified by retest. Scope and the human gate are agreed in writing before anything is touched.
The write landed, and the only record is a log.
Nothing stood between the model’s decision and the write, so the call ran with the identity it inherited and reached the data path. The finding is rated on the access the path already had.
Outcome · breach path, found by testing
Catches this branch: Adversarial testing finds it, rebuild and harden removes the inherited permissions, and a retest proves it closed.
The classes are from the threat register. The branch you pick is kept in the URL, so a shared link opens on the same branch.
Detected is not prevented.
These failures happen where a call crosses from one trust zone into another. We record every crossing in one of three states.
The agent calls the tool with whatever identity it holds. It inherits permissions nobody granted, and nothing in the flow refuses the call. AG2 lives here.
A filter or policy logs the call and lets it run. The log is evidence.
The step waits until a named person approves it. Every high-impact step on an engagement passes one, and the held branch of the path above stops here.
A crossing we have not assessed is in none of the three states. The map records it as unmapped.
What you receive, and which work produces the map.
A scoped adversarial test produces a findings report, an executive summary, an evidence bundle, and a machine-readable map of every surface in scope, all yours to keep; a secure design review produces the report, the summary and the map.
Showing 7 of 7 offers.
| Offer | What it does | Surfaces |
|---|---|---|
| Adversarial testing | We attack applications, APIs, infrastructure, models and agents the way an adversary would, including the permission and integration failures that standard testing misses. | All eight |
| Secure design review | The lightest start: we read your architecture and code against your threat model. | User, Agent, Identity, MCP Server |
| Chaos engineering | Controlled fault injection on agent, tool, and data paths, with a human gate and rollback agreed up front. | Agent, Tool, Data path |
| Rebuild and harden | The people who broke it rebuild what failed, verified by retest. | Agent, Tool, MCP Server, Identity |
| AI infrastructure | We design AI infrastructure, run hardened models in our own work, and help you run yours. | LLM, Identity, Data path |
| Binary reverse engineering | When risk sits past source, we reverse-engineer the binary in the same engagement. | Tool, Native Binary |
| Continuous Assurance | The retainer after a first engagement: closed paths re-checked every month as the system changes. | Agent, Tool, MCP Server, Identity, Native Binary, Data path |
Nothing here is self-serve: engagement options and how we quote are on Services, and the six phases are on the method page.
- 01Findings report
Every finding with the path it took, its rating, the steps to reproduce it, and the change that closes it.
- 02Executive summary
What was tested, what held, and what to fix first, written for the person who approves the fix.
- 03Evidence bundle
The record behind each finding, pinned to the run that produced it, so your team can replay it without us.
- 04Atlas map
The machine-readable map of every surface in scope. You keep it, and the next engagement starts from it.
Most first engagements are a scoped adversarial test. See what we do.
Bring us a system to map and harden.
Start with a secure design review or a scoped test. You keep the Atlas map of the system we reviewed.