A skill file, a rules file, an MCP config. Plain text, committed like documentation, reviewed like documentation, and it silently rewrites what your AI is allowed to do. Xygeni detects the malicious skills, poisoned prompts and unsafe agent boundaries that your code scanners were never built to look for.
Read-only access · Scans run in your infrastructure · Your code is never uploaded
Discover AI agents, prompts, and MCP configurations across your codebase, detect hidden risks, and prioritize the issues that matter before they reach production.
Continuous, automatic discovery across your repositories: models, frameworks, datasets, inference endpoints, agents, MCP servers, skills, prompts, guardrails, and the AI coding tools your developers actually use. No surveys, no self-reporting.
A dedicated AI scanner finds the failures specific to AI systems: prompt injection, tool injection, data leakage through retrieval, system prompt bypass, excessive agency. Each finding is mapped to the AI security frameworks your team already uses, and points at the exact line of code that creates the exposure.
The prioritization funnel narrows every AI finding down to what is reachable in application code, genuinely exploitable, and sitting in code your teams are actively developing. Teams work the few findings that matter.
From Shadow AI to an Audit-Ready Inventorygk
See your total AI footprint and how much of it carries risk, tracked against a baseline so you know whether your exposure is growing. Every asset carries its own risk score, its provider, its type, and its exact location in your code.
An AI asset in isolation tells you little. The graph shows the relationships that carry the risk: which model a dataset feeds, which agent invokes which tool, which MCP server sits behind an assistant, and where the risk concentrates across that chain. Filter by asset category, type, relationship, or risk level.
Export a machine-readable bill of materials for your AI, generated from the same continuous discovery that powers the inventory. When an auditor, a customer, or a regulator asks what AI you are running, the answer is a download, not a three-week manual exercise.
Skill files, rules files and MCP configs are committed as plain text and reviewed as if they were harmless, yet they define what an assistant is instructed to do and what it is allowed to reach. Xygeni analyses them as security artifacts: it flags malicious skills and rules files, inspects MCP server configurations, and surfaces the prompts that drive your AI workloads.
Xygeni’s AI scanner detects the failure modes that are specific to AI systems and invisible to conventional code analysis: malicious manipulation of tool execution, unauthorized retrieval of sensitive documents through a vector store, system prompt bypass, jailbreaks through crafted input, untrusted tool invocation.
Every AI finding carries the framework reference, the affected AI asset and tool, how long the exposure has been open, the exact file and line, an explanation of why it matters, and mitigation split into general controls and guidance specific to that finding. Not an alert. A fix.
Progressive filtering from every finding down to those in application code, then to those that are exploitable, then to those in active development. The list that reaches your team is the list that threatens production.
An honest AI risk picture needs more than a model inventory, and Xygeni already runs the engines that complete it:
API keys for AI providers are secrets like any other, and Xygeni’s secrets detection finds them across your repositories, configuration files and pipelines, before they reach a public registry or a build log.
The AI stack is built on ordinary packages, and ordinary packages carry CVEs. Xygeni’s software composition analysis surfaces known vulnerabilities in the AI and ML libraries your applications depend on, in the same platform as the AI assets that use them.
AI stacks pull dependencies fast and from many sources. Xygeni’s malware detection catches malicious packages that reputation-based tools still trust, without waiting for a CVE or a public advisory.
One platform, so the AI question gets a complete answer instead of three partial ones from three different tools.
See the AI attack surface your existing security tools can’t, and manage it alongside every other application risk.
Your static analysis does not know what a model is. Your composition analysis does not list MCP servers. This is not a defect in those tools, they were designed for a different problem. Xygeni inventories AI assets, analyses MCP configurations, flags malicious skill and rule files, and builds your AI-BOM.
AI findings live alongside your code, dependency, secret, pipeline and API findings, in one console with one prioritization model. AI is a new attack surface, not a reason for a new tool with its own login.
Xygeni aligns with the frameworks that now govern AI in software: the OWASP Top 10 for LLM Applications, for MCP and for Agentic Skills, NIST SP 800-218A, and the CISA and G7 guidance on a Software Bill of Materials for AI. It generates the evidence that helps demonstrate those frameworks are being applied, and supports the inventory and traceability expectations that regulations such as the EU AI Act, NIS2 and Spain’s ENS are placing on organizations.
The direction is set: the SBOM is expanding into the AI-BOM. You cannot attest what you have not inventoried.
Models, AI frameworks, datasets, inference endpoints, agents and agent servers, MCP servers, skills, prompts, guardrails, and the AI coding tools in use across your repositories.
By analysing your repositories continuously: code, dependencies, and the configuration files that AI tools leave behind. Nothing depends on developers self-reporting what they use.
An AI Bill of Materials is a machine-readable inventory of the AI in your software: models, datasets, components, providers and dependencies. Regulators and standards bodies are converging on it as the evidence base for AI governance, and you cannot attest to what you have not inventoried.
AI-specific failure modes including prompt injection and system prompt bypass, tool injection and untrusted tool invocation, data leakage through retrieval, and excessive agency, mapped to the OWASP Top 10 for LLM Applications.
Yes. Every finding points to the file and line, explains why it matters, and gives mitigation both as general controls and as guidance specific to that finding.
Those tools analyse code and dependencies. They do not model what an AI agent is, what an MCP server exposes, or what a skill file instructs an assistant to do. Xygeni adds that layer and keeps it in the same platform as the rest of your findings.
Yes. The inventory tracks against a baseline, so you can see what AI was introduced, changed or removed between scans.
Start free, or schedule a demo and we will walk through your AI attack surface with you.
nganggo Platform Xygeni All-In-One AppSec
