Viewing profile — XiaHua

We monitor both the app layer and the MCP servers. We run a hosted version of https://github.com/traceforce/mcp-xray in our backend to constantly pentest MCPs and their supply chai…

It's always a trade-off between serverless and how much customization we want. The Kong plug-in is easy to customize for us.

Thank you!

Good luck to your startup as well!

What do you use to host your public MCP server? We use Kong and they have lots of security plug-ins to choose from. For example https://developer.konghq.com/plugins/bot-detection/

I'm curious how your pentesting tool handles the frequent updates in AI app behaviors and MCP APIs without overwhelming false positives? ---> Our pentest tool has a "secret" step c…

oh and to add on this, MCP gateways work mostly with remote MCPs only. For the stdio ones, we still need local agents to take care of the controls.

Thanks for reaching out out. We have one already https://traceforce.trust.cyberbase.ai/

Yes you are spot on! On-device agents can only do so much. We integrate with popular gateways such as Kong to bring MCP controls. We primarily manage the registries for MCPs with v…

That's a great example. It's exactly the kind of behavior we think deserves more attention. It's not a traditional vulnerability but it can significantly influence an agent's decis…

I will definitely checkout Runlayer Watch in depth. It seems that it works with coding agents but not web-based agents yet. We've had customers comparing the two solutions. They li…

Runlayer can be a fit once you know what you want to put behind an MCP gateway. The challenge we hear from customers is that they don't know what AI apps, MCPs, or tools their empl…

Thanks for the feedback! I agree that DROP TABLE executes remotely. The key point is that the decision to invoke the tool is made by coding agents like Claude Code. Traceforce capt…

We are also curious to ask what existing tools are folks using to gain visibility into what's running out there?

Hey HN, we’re Xia and Varun, the founders of Traceforce ( https://www.traceforce.ai/ ). Traceforce provides visibility and control over AI apps such as ChatGPT, Claude etc directly…