Small data point from the operator side: I run a tiny public MCP server, and when I finally turned on request logging, almost none of the traffic was what I expected. Mostly link-preview bots, keepalive pings, and scanners probing for wp-admin on an endpoint that isn't even WordPress. Made me realize most small MCP deployments probably have zero visibility into this — people ship a server and never look at what's actually hitting it. So the "you can't flag risky AI-generated commands without context" point resonates; at the low end the problem is even more basic, there's no context at all.
Launch HN: Traceforce (YC S26) – Company-wide security monitoring for AI apps
21–30 of 31 posts
Re: Launch HN: Traceforce (YC S26) – Company-wide security monitoring for AI apps
#22Small data point from the operator side: I run a tiny public MCP server, and when I finally turned on request logging, almost none of the traffic was what I expected. Mostly link-preview bots, keepalive pings, and scanners probing for wp-admin on an endpoint that isn't even WordPress. Made me realize most small MCP deployments probably have zero visibility into this — people ship a server and never look at what's act…
What do you use to host your public MCP server? We use Kong and they have lots of security plug-ins to choose from. For example https://developer.konghq.com/plugins/bot-detection/
Re: Launch HN: Traceforce (YC S26) – Company-wide security monitoring for AI apps
#23Congratulations, have you thought about setting up a professional trust center? you can try https://sekorti.com
Thanks for reaching out out. We have one already https://traceforce.trust.cyberbase.ai/
Ok and thanks for your kind reply, and once again all the good luck with your startup!
Re: Launch HN: Traceforce (YC S26) – Company-wide security monitoring for AI apps
#24Re: Launch HN: Traceforce (YC S26) – Company-wide security monitoring for AI apps
#25Hey Xia! Super excited for this- good talking to you a few weeks ago and best luck with the launch :)
Thank you!
Re: Launch HN: Traceforce (YC S26) – Company-wide security monitoring for AI apps
#26Small data point from the operator side: I run a tiny public MCP server, and when I finally turned on request logging, almost none of the traffic was what I expected. Mostly link-preview bots, keepalive pings, and scanners probing for wp-admin on an endpoint that isn't even WordPress. Made me realize most small MCP deployments probably have zero visibility into this — people ship a server and never look at what's act…
What do you use to host your public MCP server? We use Kong and they have lots of security plug-ins to choose from. For example https://developer.konghq.com/plugins/bot-detection/
Cloudflare Workers — the whole thing is a single stateless worker in front of a vector index, so I get TLS, DDoS filtering and bot scoring at the edge without running any infra myself. The tradeoff is you're limited to what the platform exposes; something like a gateway with pluggable security policies would matter more once there are write-capable tools involved. Mine is read-only search, which keeps the attack surface pretty boring — probably why my logs are mostly scanners looking for a WordPress that doesn't exist. Thanks for the Kong pointer, will take a look.
Re: Launch HN: Traceforce (YC S26) – Company-wide security monitoring for AI apps
#27[dead]
Re: Launch HN: Traceforce (YC S26) – Company-wide security monitoring for AI apps
#28Congrats on the launch. The timing is notable — Trend Micro just audited 9,695 public MCP servers and found 4,982 security issues across 2,259 of them (2,054 with no authentication at all), and their conclusion was that neither popularity nor verification status reliably indicates safety. Meanwhile the 2026-07-28 MCP spec adds new surfaces (extensions, sandboxed HTML apps) that most scanners don't cover yet.
Curious how you think about coverage: are you monitoring the app layer only, or also the MCP servers and tool supply chain the apps pull in? The "verified badge ≠ safe" finding suggests directory-level trust signals aren't enough on their own.
Re: Launch HN: Traceforce (YC S26) – Company-wide security monitoring for AI apps
#29[dead]
Re: Launch HN: Traceforce (YC S26) – Company-wide security monitoring for AI apps
#30Earlier quoted context omitted.
What do you use to host your public MCP server? We use Kong and they have lots of security plug-ins to choose from. For example https://developer.konghq.com/plugins/bot-detection/
Cloudflare Workers — the whole thing is a single stateless worker in front of a vector index, so I get TLS, DDoS filtering and bot scoring at the edge without running any infra myself. The tradeoff is you're limited to what the platform exposes; something like a gateway with pluggable security policies would matter more once there are write-capable tools involved. Mine is read-only search, which keeps the attack surf…
It's always a trade-off between serverless and how much customization we want. The Kong plug-in is easy to customize for us.