Studio

Approved packages, pinned to exact versions.

Your AI agents build from the packages you approved, at the versions you approved. Adding one takes a named person, and the ask arrives with the public security advisories already on it. Nothing ships on a scan nobody read.

One list, exact versions, humans add

An approved package is pinned to one exact version. Adding one takes an administrator, and the check that runs first refuses packages already known to be malicious, flags names that are one typo away from a popular one, and stops a critical or high advisory unless a named human accepts the risk in writing. If the advisory service cannot be reached, the answer is unknown, never clean.

The list is watched after approval

A package is safe on the day you approve it and may not be safe next month. A check runs every day against every package your organization approved, and raises an alert when a new advisory lands on one of them. It tells you. It does not email your clients or open work on its own; that stays a human's decision.

Ask for a scan in plain words

Type what you want scanned, or paste a link to a code repository. It runs as an AI agent acting for you, so it reaches the repositories you reach and no others. It finds it, makes a copy on a machine of its own, checks the packages and hunts for keys left in the code, and writes down what it did, step by step, while you watch. It can find and report. Every tool that would act on a finding is taken away from it.

Your code stays where the check runs

The copy is made on your organization's own machine, and the platform keeps what the checks reported rather than your source. A key left in the code is reported by rule, file and line. On the AI agent's path, the key itself is blanked out before the model, the transcript or the record ever sees it.

A human decides what a finding means

Every finding lands in one table with how bad it is, where it is, and where it stands. A human records the verdict: still open, confirmed, or a false alarm. Nothing marks itself resolved. Findings from tools you already run can be brought in, and they arrive as claims to check rather than answers.

Product shot pendingThe Findings tab on a clean record: filters for severity, target and status, a count reading nought of nought, and a card saying the recorded runs hold no findings

Your AI agent instructions are scanned too

An AI agent works from an instruction file somebody wrote. Those files are checked for attempts to talk the AI agent out of its rules, keys typed straight into the text, tries at getting out of the box it runs in, and anything that would quietly stay behind. The check runs when the file is saved, and again before anybody shares it with the rest of the organization.

Nothing ships on a scan nobody read

A project can require a recent scan before anything goes live. No scan on record and it is refused. A critical or high finding nobody has cleared, and it is refused too, whether the finding came from ALOS's own scanner or from a tool you already run. Approving a package refreshes the project's parts list at the same moment, so the list never lags the decision.

Bring a repository and watch it scanned end to end.

Talk to us

Also in Studio