A local-first scanner for the software a developer actually installed for agents: Claude Code skills, MCP servers, Cursor/VS Code extensions, coding-agent CLI plugins, and the transitive PyPI/npm packages they pull in. It builds an inventory of what is installed and what can reach credentials, pins versions into a lockfile, checks every artifact against a continuously updated advisory feed, and shows a one-screen 'what changed since yesterday' diff when any of them silently updates.

Market Panorama

Competitive Intelligence

Users & Demand

Business Model

Market Sizing

Tech Solution & Build Plan

Go-to-Market Strategy

Risk Assessment

Action Recommendations

### Market definition and scope

The agent-toolchain integrity layer covers everything an operator installed specifically so their coding agents would work: skills published as raw repositories, MCP servers pulled from package registries, editor extensions installed from a marketplace, harness plugins that self-update, and the transitive npm and PyPI dependencies all of those drag in. The product's job is to make that set knowable — inventory, pin, hash, match against advisories, and report drift at the machine level rather than the repository level.

The scope boundary matters. It is not an SCA scanner for application dependencies, though it overlaps with one at the package edge; it is not endpoint detection, though a resident agent is endpoint software; and it is not secret scanning, though the reason anyone cares is that agent tooling can read credentials. Its unit of value is the answer to a question a founder cannot currently answer without an incident: what is installed, what can it reach, and what changed since yesterday.

October made that question urgent in three separate shapes. A Claude Code VS Code extension distributed through the Cursor Marketplace was backdoored (Hacker News, 1,008 points / 553 comments). OpenCode was breached and user credentials leaked (977 / 185). LiteLLM 1.107.0 on PyPI shipped a credential stealer and backdoor (596 / 201). Three artifacts — an extension, an application, a package — three vectors, one month. A scanner built around only one of those classes would have missed two of October's three events, which is the clearest available argument that the inventory has to be general.

### Key trend signals with data citations

The resident-agent trend is what converts a nuisance into an exposure. Codex CLI installs a persistent, self-updating background daemon by default, with no opt-out — a front-page issue at 610 points and 294 comments (Hacker News, October 2026). A tool that runs once and exits has a bounded blast radius; a tool that stays resident, self-updates and holds credentials has an unbounded one. Compromise in that environment is not an incident, it is a standing capability.

The infrastructure context is that trust failed at unrelated layers in the same window. eMudhra announced it would exit the global SSL/TLS certificate business after an intermediate CA compromise (1,157 points / 745 comments), and Apple's git was reported to still trust the compromised certificates days later (1,202 / 413). Neither is an agent-tooling story, and both are relevant: the operators this product serves have concluded, correctly, that infrastructure they assumed was verified is not, and that discovery comes from other affected people rather than from monitoring.

The adoption signal for the category itself is microsoft/TokenEconomizer at 4,557 stars — a Microsoft project that instruments coding agents to control cost. It proves teams will install instrumentation aimed at their agent stack when the cost of not doing so is visible. Spend visibility and integrity visibility are the same purchasing instinct applied to two different risks.

### Why now

Four things converged this month. Attacks targeted the agent layer specifically, which is the layer with no scanner coverage. Agents became resident and self-updating, which removed the natural churn that used to retire a compromise. Each incident produced a public post-mortem, which is a free and credible seed corpus for a curated advisory feed. And the incumbent supply-chain vendors are structurally pointed elsewhere: Snyk, Socket and Dependabot sell into application and repository risk, where their customers' budgets and workflows already live.

The mechanical reason the window closes is straightforward. Once an incumbent sees agent tooling as a line item, extending coverage is a quarter of work for them and a year of differentiation lost for the founder. The defence is not features; it is the curated advisory corpus, which is slow to build and hard to fake.

### Market maturity

Early. There is no established category, no standard for what constitutes an agent-tooling inventory, and no shared advisory schema for skills or MCP servers. The October incidents establish the problem space but not the market: the failure of a category to exist yet is different from a category being crowded, and this one is genuinely empty. Early markets reward being first with something usable; they punish anyone who waits for the schema to be standardised by someone else.

### What this means for a solo founder

The wedge is a read-only scan that produces a shareable inventory in thirty seconds, because that artifact is simultaneously the product, the marketing and the evidence. The paid product is the advisory feed plus drift alerting, which means the founder's real job in month one is curation and outreach, not engineering. Engineers who build this as a feature-binary and skip the advisory work will ship a tool nobody needs twice.

A Claude Code VS Code extension backdoor (1,008 points), an OpenCode breach (977) and a poisoned LiteLLM PyPI release (596) hit extensions, applications and packages respectively within three weeks.

Three compromises, three artifact classes

Codex CLI installs a persistent self-updating daemon by default (610 points / 294 comments), so a compromised tool stays resident rather than running once.

Resident agents amplify blast radius

eMudhra's intermediate CA compromise forced an exit from the certificate business (1,157 points) while Apple's git still trusted the bad certificates (1,202 points).

Trust failed at three unrelated layers

microsoft/TokenEconomizer reached 4,557 stars for black-box cost control over coding agents, proving adoption appetite for tooling aimed at the agent stack itself.

Agent Toolchain Integrity Scanner