agentinfra

Congrats on the launch. The timing is notable — Trend Micro just audited 9,695 public MCP servers and found 4,982 security issues across 2,259 of them (2,054 with no authentication at all), and their conclusion was that neither popularity nor verification status reliably indicates safety. Meanwhile the 2026-07-28 MCP spec adds new surfaces (extensions, sandboxed HTML apps) that most scanners don't cover yet.

Curious how you think about coverage: are you monitoring the app layer only, or also the MCP servers and tool supply chain the apps pull in? The "verified badge ≠ safe" finding suggests directory-level trust signals aren't enough on their own.