SecuritySupply chain

Security that starts before your code runs.

Most of what runs in an AI agent is other people's code: a base image, a model SDK, dozens of transitive packages. We control what we can, scan the rest, and put you in charge of every change to your app.

Overview

What happens after `git push`

Each push starts a fresh, single-use build job. Your source never leaves the platform's own git server and container registry.

CloneYour commit, from the built-in git server.
PrepareThe runtime writes the Dockerfile from the base-image catalog.
BuildUnprivileged, no credentials, allowlisted network.
ScanTrivy checks OS packages and libraries.
PushTo a private registry in our AWS account.
DeployRolled out to your agent's HTTPS address.

Base images

A catalog we own, not whatever a tag points to today

Builds may only start from images in our catalog. A daily job copies them from upstream into our own registry, and builds reference them by digest, so a rebuild can't silently pick up a different base.

Runtime	Build image	Runs on
Python	Python 3.10, 3.11, 3.12, 3.13 (slim)	The same slim image
Go	Go 1.23, 1.24, 1.25, 1.26 (Alpine)	Distroless static, non-root
LangChain	Python, plus the platform harness	The same slim image

Your repository can't override the base image: a Dockerfile in it is ignored with a warning in the build log. That rule, the catalog and build isolation protect every tenant, so they can't be switched off.

Build isolation

Your install step can't phone home

Builds run with kaniko in an unprivileged container, on a separate pool of machines that exists only while builds run.
The step that runs your pip install or go build has no cloud credentials, no cluster token, and no privilege escalation.
Network access is an allowlist: our registry, PyPI and the Go module proxy and checksum database. Arbitrary downloads and exfiltration from a build are blocked.

Scanning

Scanned when it's built, and every day after

At build time

Trivy scans every image for known vulnerabilities in OS packages and language dependencies. Results are stored with the build and shown on the agent's page and in mb agent scan.

Daily rescan

New CVEs are published against old packages all the time. Running images are re-checked about once a day against the latest vulnerability database, without rebuilding.

Never blocks a deploy

A finding doesn't stop your release. Findings are listed by severity on the agent, so you decide what to fix first.

On by default, opt-out on record

An agent's owner or a workspace admin can turn scanning off for an agent or a whole workspace. A reason is required, and the change is logged and badged.

Reviewed fixes

We propose. You review the diff. Then it ships.

The agent's Security tab lists each finding with its status. Where a fix exists, we prepare it for you:

a version bump in requirements.txt or go.mod;
or a rebuild, for OS packages and the Go toolchain, which picks up the refreshed base image.

You see the exact change before anything happens.
Confirming commits it to the agent's repository as you, and the platform builds it.
Dismissing a finding records who did it and why.

At runtime

Agents are fenced in by default

Agent pods accept traffic only from the ingress and the platform. Private agents have no public route at all and are reachable only from the same workspace.
Pod-to-pod traffic between nodes is encrypted with WireGuard.
Machines run Bottlerocket, a minimal container OS, on Amazon EKS in AWS us-west-1.
Every agent gets HTTPS with an automatically renewed certificate, including on your own domains.

Secrets and access

Least privilege, with a paper trail

Secrets

Encrypted at rest with AES-256-GCM under an AWS KMS key, bound to the agent and the key name. Values can be copied between agents without anyone seeing them. Reading one back needs the owner or a workspace admin, a person (not an automation), and a reason; each read is logged.

Access levels

Workspace members can read; an agent's contributors can ship; its owner and workspace admins can manage. Invites are bound to a verified email address, and a departing member's agents pass to the workspace owner.

Roadmap

What we're building next

Signing every image we build, and admitting only signed images from our registry.
A notice when a newer base image is available, offered as a proposed rebuild.

Found a security issue? Email hello@mesangebleue.io.

See your first scan in minutes.

Push an app you already have and open its Security tab.

Create a workspace All offerings

What happens after git push