Category 10 of 12 · Controls: Where models, servers, and skills come from

Model and agent supply chain

Scanning and vetting of models, MCP servers, agent skills, and extensions before they are installed, to catch malicious or vulnerable components.

Mitigates: ASI04 Agentic Supply Chain Vulnerabilities, LLM03 Supply Chain, LLM04 Data and Model Poisoning · MITRE ATLAS AML.T0010, AML.T0018

Vendors, by signal score

• #1
  AIR

  Context firewall for AI agents: vets skills, plugins, MCP servers, and sub-agents before they are installed, keeps a marketplace of approved add-ons, discovers sanctioned and shadow agents, and blocks malicious agent actions at runtime.

  31
• #2
  Invariant LabsAcquired by Snyk

  Research-led agent security: MCP-Scan (now Snyk Agent Scan) finds tool poisoning, rug pulls, and cross-server tool shadowing in MCP servers and agent skills, alongside Guardrails and Explorer for runtime rules and agent trace inspection. Acquired by Snyk in 2025.

  25
• #3
  KoiAcquired by Palo Alto Networks

  Agentic endpoint security: inventories the AI agents, models, MCP servers, extensions, and skills installed on endpoints, applies policy to them, and removes risky packages and AI tools. Acquired by Palo Alto Networks in 2026 and now sold as Cortex Agentic Endpoint Security.

  21

Ranked within this category only. How the score works.

Also covers this category

• FortinetPlatform suite

  FortiAIGate guards LLM traffic against prompt injection, data leakage, and model poisoning; the Virtue AI acquisition adds agentic red teaming, agent and MCP tool discovery and scanning, blocking of malicious tool calls, and real-time guardrails.

  45
• HiddenLayer

  AI security platform with runtime detection and response for models and agents: evaluates model requests, responses, and tool calls against policy and can block or redact them, alongside AI discovery, supply chain scanning, and attack simulation.

  47
• Knostic

  Need-to-know access control for enterprise AI: finds where assistants such as Microsoft 365 Copilot overshare data, and its Kirin product enforces least-privilege profiles and runtime guardrails for agents, coding assistants, and MCP servers.

  15
• Palo Alto NetworksPlatform suite

  Prisma AIRS: AI runtime security, agent security, AI red teaming, model scanning, posture management, and an AI gateway, built partly from acquisitions of Protect AI, Koi (agentic endpoint security), and Portkey (now Prisma AIRS AI Gateway), with CyberArk as its identity security platform.

  65
• PromptArmor

  AI third-party risk intelligence for the agent supply chain: vendor reports scored across 26 AI risk vectors and mapped to the NIST AI RMF, OWASP LLM Top 10, and MITRE ATLAS, indirect prompt injection assessment of vendor connectors, and continuous monitoring of vendor AI changes.

  10
• PromptfooBeing acquired by OpenAI

  Open-source red teaming, static scanning, and evaluation for LLM applications and agents, with plugins for tool misuse, MCP, memory poisoning, and prompt injection. OpenAI agreed to acquire it in March 2026 and committed to keep it open source.

  31
• Protect AIAcquired by Palo Alto Networks

  AI and ML security company behind model scanning, runtime LLM protection, and the open-source LLM Guard toolkit. Acquired by Palo Alto Networks in 2025; protectai.com now redirects to Prisma AIRS, and the LLM Guard repository is archived.

  30

Questions to ask a vendor

1. Does it scan model files for embedded code and backdoors?
2. Does it vet MCP servers and skills before an agent can install them?
3. Does it keep a bill of materials for every agent?

Go deeper

• MLSecOps shortlist

FAQ

What is an agentic supply chain attack?

A malicious or compromised model, MCP server, skill, or library that an agent loads, giving the attacker a foothold inside a trusted workflow.

Can a model file run code?

Some serialization formats execute code when loaded. Model scanning checks for that before the file reaches production.