The thesis

Every AI agent needs a credit file.

Redthread is building the bureau, and the road it runs on.

Neutral, signed, checkable by anyone: who an agent is, what its tools are, and what it did.

55,375
MCP servers in our daily signed registry scan (2 Nov 2026)
1,518
listings that changed hands under an approved name
1,500 of 1,515
container images a movable tag can silently repoint
$4.8B → $7.7B
market for securing AI, 2027 → 2028 (Gartner)
The problem

Agents are becoming infrastructure.

They are persistent, composed across services and vendors. They hold real credentials and call tools their owners didn't write — mostly MCP servers, approved by name while the code behind the name keeps changing.

Already live

EchoLeak

A zero-click data-exfiltration flaw in an AI assistant, rated CVSS 9.3.

Already live

postmark-mcp

A malicious MCP server that quietly copied the email it was trusted to send.

Already live

1,518 registry listings

Listings whose name now points somewhere other than where it started. Approved by name; changed hands since.

Adoption is outrunning control.

79%
of enterprises run agents
2%
use purpose-built governance tools
The idea

A credit bureau for agents.

A credit bureau doesn't lend. It keeps one neutral record any lender can check — and neutrality is the product. Agents need the same: every vendor will issue identities to its own agents, and none can grade its own honestly.

The Agentic Trust & Protection Platform (ATPP) is that neutral record. Every claim is signed (Ed25519, in-toto), anchored in public logs, and verifiable offline, without trusting us.

Credit bureau

Equifax, FICO

One neutral record and score any lender can check.

Certificate authority + public log

DigiCert, Let's Encrypt

Signed identity in a transparency log — verify without calling the issuer. ATPP anchors claims in Sigstore Rekor.

Safety mark

UL

An independent test buyers recognise. Our badge is a signed file, not an image.

Build the road first

Roads come before traffic rules and toll booths.

Ours, the scan, is already built. No permission asked.

1

The road Live

A daily signed scan of the whole official MCP registry. It built the evidence layer (keys, key list, verify flow), a map of the tool supply (versions, hashes, provenance, fingerprints), and distribution — installers meet our signed claims before our sales team.

2

The vehicles Live Preview

Cryptographic agent identity (SPIFFE), signed action records, verify badges and self-serve signup are live. In preview: a Claude Code and Cursor gate and hooks, and Enforce, a gateway that checks each request and its content.

3

The bureau Next

Any API, site, bank or MCP server can ask four questions about any agent. Phase 0 is built: vault-sealed signing keys, an uneditable ledger, a transparency log. Each next step starts when a design partner asks.

?
Who is this?The agent's cryptographic identity.
?
Who sent it?The operator that deployed it.
?
Is it still good?Whether it has been revoked.
?
What is its record?What it did, on the ledger.
What is real today

Built, public, and checkable.

The Redthread Security platform

  • Agentless AI risk assessment — the free scan
  • Exploit validation with reproducible proof
  • Shadow-AI discovery and posture / DSPM
  • CI/CD gating and attestation reporting
  • Compliance reporting — SOC 2, ISO 27001/42001, PCI DSS, GDPR — from the same findings

The public trust record

  • Public CLI and verifier — github.com/bl014h/atpp; official MCP Registry
  • Rekor-anchored scan and Sigstore keyless co-signing
  • ToolHive integration
  • Hourly canary, daily red team — all public
Who pays

Checking a record is free. That's what makes it neutral.

Free

Anyone who checks

Look up any agent, server or badge. The record is public and verifiable offline.

$149 /mo

Builders

Pay for identity, badges and enforcement. Team $149/mo, Business $499/mo.

Quote

Enterprises

Pay for the assessment and attestation. See pricing →

Why this wins

Identity is the layer no single vendor can own.

The agentic stack is factoring into layers — models, orchestration, memory, execution, identity, payments. Everyone else has to trust identity, so a third party has to check it.

  • Identity is being bought. Cisco–Astrix, SailPoint–Entro (~$123M), Cyera–Oasis (~$1B).
  • Rivals each own one layer. Dashboards don't issue identity; runtime guards watch behaviour, not credentials; cryptographic-identity tooling has no AI-app security.
  • Open, so others build on it. Our formats and verifiers are open. The log's history and the relying-party base can't be back-filled by a copycat.
Models layer 1
Orchestration layer 2
Memory layer 3
Execution layer 4
Identity the neutral layer
Payments layer 6
Start here

See the record for yourself.

The scan, the signed claims and the verifier are public. Check an MCP server in a minute, or run a free assessment of your own estate.

See the live record Start a free assessment