# Bindfort

> Bindfort is an AI agent security and evidence platform for MCP-based applications. It focuses on installed dependency risk, pre-call tool policy, and tamper-evident receipt verification.

## Public product pages

- [AI Agent Security](https://bindfort.com/ai-agent-security): Category overview, verified capabilities, and roadmap boundaries.
- [MCP Security Scanner](https://bindfort.com/mcp-security-scanner): Installed dependency-tree scanning and evidence review.
- [Agent Security Testing](https://bindfort.com/agent-security-testing): Controlled pre-production testing for MCP tool paths.
- [Agent Permission Audit](https://bindfort.com/agent-permission-audit): Tool-level permissions, policy, and least-privilege review.
- [Prompt Injection Security](https://bindfort.com/prompt-injection-security): Tool poisoning and indirect prompt-injection guidance.
- [Agent Runtime Security](https://bindfort.com/agent-runtime-security): Pre-call policy and post-call evidence at the MCP boundary.
- [AI Agent Vulnerability Scanner](https://bindfort.com/ai-agent-vulnerability-scanner): Agent, MCP server, dependency, and tool attack-surface assessment.
- [AI Visibility Methodology](https://bindfort.com/ai-visibility): Methodology and current status only. No live provider benchmark, score, ranking, citation rate, or fixture-derived result is published.
- [Company and Product Facts](https://bindfort.com/company): Citation-ready category, capability, evidence, and product-status facts for analysts and editors.
- [Pricing](https://bindfort.com/pricing): Published launch prices, package boundaries, current availability, and design-partner terms.
- [Public CLI releases](https://github.com/bindfort/cli/releases/latest): Account-free scanner-only binaries for Windows, macOS, and Linux, with checksums.
- [Homebrew tap](https://github.com/bindfort/homebrew-tap): One-command scanner installation for macOS and Linux.

## Technical evidence

- [11 MCP servers, two scan paths, one large gap](https://bindfort.com/research/mcp-installed-tree-measurement-2026): Corrected August 2026 measurement of 11 published MCP server packages: 130 normalized installed-tree advisory matches versus 2 top-level matches, with dated evidence and a sourced MCP gateway capability comparison.
- [MCP Security: Complete Technical Guide](https://bindfort.com/mcp-security)
- [Bindfort Research](https://bindfort.com/research)
- [All Research](https://bindfort.com/research/all)
- [Security Posture](https://bindfort.com/security)
- [Research Disclaimer](https://bindfort.com/research-disclaimer)

## Verified current scope

- Public, account-free installed dependency-tree scanning for local MCP server directories.
- Controlled allow and deny policy decisions before upstream MCP execution.
- Tamper-evident receipt generation and local receipt verification.
- Structured evidence for security, audit, and vendor-risk review.

## Important limitations

- The scanner-only CLI is publicly downloadable; the gateway and paid production packages remain guided rather than general self-service.
- Production isolation, automated incident response, broad compatibility packaging, and continuous monitoring remain roadmap items.
- Bindfort provides technical controls and evidence; it does not by itself make a system compliant with any law or standard.
- No source code, credentials, customer data, raw provider answers, private prompts, or internal operational details are published through this file.

## Contact

- Website: https://bindfort.com
- Security: security@bindfort.com
- General inquiries: contact@bindfort.com