The AI Exposure Score
One grade, from A to F, for how much of your AI and agent infrastructure an attacker can see and reach from the open internet — with no login and no active testing. This page is the rubric; there is no black box.
How a scan works
- 1Attribute the domain to its internet-facing hosts (certificate transparency, passive DNS, subdomain enumeration).
- 2Probe candidate surfaces for AI/agent fingerprints — MCP, A2A agents, model APIs, orchestrators, vector databases.
- 3For each confirmed surface, test whether it is authenticated, then read (never call) its advertised capabilities.
- 4Grade exposure and exploitability from those passive signals, and assemble the register.
Signals that move the grade
Exposed vs. secured
Every discovered endpoint is tested for an auth wall on a sensitive path. A 401/403 means secured; a service that answers without a credential is exposed. Only exposed surfaces raise your grade.
Exploitability (passive)
For an exposed MCP we read — never call — its tool manifest and check the auth signals the spec defines: OAuth protected-resource metadata, WWW-Authenticate, per-tool auth parameters, dynamic client registration, and PKCE. Destructive or data-access tools with no gating grade higher than read-only ones.
Reachability
CORS posture (an arbitrary-origin allow means browser/DNS-rebinding reachable) and self-signed/expired TLS are treated as amplifiers, not just cosmetic.
Corroboration
Open-source detection templates and read-only MCP posture analysis (YARA) corroborate findings. All detection-only — no attack traffic is ever sent.
The grades
No exposed AI/agent surfaces attributable to the domain (authenticated servers are fine).
Only low-severity exposure — informational surfaces reachable, nothing dangerous.
Medium-severity exposure present — surfaces that warrant review.
High-severity exposure — an unauthenticated agent/model surface with reachable capability.
Critical exposure — e.g. an unauthenticated MCP whose destructive or data-access tools are callable.
The grade is capped whenever a critical or high-severity exposure is present, so a single unauthenticated, capable MCP cannot be averaged away by otherwise-clean infrastructure.
What stays private until you verify ownership
The public report shows counts and your grade — never the coordinates. Endpoint URLs, exposed tool names, MCP catalogs, and per-asset findings are revealed only after you sign up and prove you own the domain. That way a scan can’t be used as a target list against someone else.