Skip to content
subcloak
Book a test

Security apps for developers.
Security tests for your app.

Cloak Proxy and Cloak Watch are free on Mac. Our tests are AI-fast, human-proven: AI covers everything, and a person proves and signs every finding.

Get a testPentests: web, API, mobile, network, cloud.Plus AI features and dev environments. Signed reports, a free retest. From $1,800≈€1,600≈£1,400≈CA$2,600≈A$2,600≈S$2,300≈AED 6,600₹55,000.See the tests Download the appsCloak Proxy, Cloak WatchFree for Mac. Cloak Proxy in beta on Linux. No account.Get the apps

Apps

Free apps developers run every day.

The tools we test with, given away: no account, no trial clock.

All apps
Cloak Proxy's traffic list: requests from Safari, Chrome, curl and other apps, with a decrypted JSON response open (sample data)

Cloak Proxy

0.7.4 · Mac · iPad · Linux beta · free for life

See every request your Mac makes. A native debugging proxy with an API client built in: decrypt, pause, mock and break requests, see what every model call costs, and test authorization from the traffic you already have.

Download freeAbout Cloak Proxy
Cloak Watch's Home: Your Mac is clear, with counts of packages, extensions, AI tools, startup items and keys checked (sample data)

Cloak Watch

1.2.0 · Mac · free

Is your Mac affected? Know in seconds. Checks packages, extensions, MCP servers, agent skills and startup items against new supply-chain attacks, and fixes what it finds in one click.

Download freeAbout Cloak Watch

Testing

Security testing, AI-fast and human-proven.

AI maps and probes everything in days. A person proves each finding, tests what AI misses, and signs the report your auditor and customers accept.

All about testing

01 · For SOC 2, ISO 27001 and enterprise deals

Proof Pentest

AI covers your whole web app and API in days. Then a person tests every role and tenant by hand, proves each finding, and signs the report your auditor and customers will accept.

$4,900–9,500≈€4,400–8,500≈£3,700–7,200≈CA$7,000–13,500≈A$7,000–13,600≈S$6,300–12,200≈AED 18,000–34,900from ₹95,000

Report in 5 working days

02 · For copilots, chat, RAG, agents and MCP

AI Feature Security Test

Can your AI feature be talked into leaking another customer's data, or into using its tools in ways you never meant? We test it the way attackers do, prove the answer, and sign it.

$6,500–18,000≈€5,800–16,100≈£4,900–13,600≈CA$9,200–25,600≈A$9,300–25,800≈S$8,300–23,000≈AED 23,900–66,100₹1,50,000–3,40,000

Added to a Proof Pentest: $2,500≈€2,200≈£1,900≈CA$3,600≈A$3,600≈S$3,200≈AED 9,200₹75,000

03 · After a supply-chain attack

Dev Environment Compromise Check

When the next npm, PyPI or AI-agent supply-chain attack hits, know within 48 hours whether it reached your developers' Macs, your CI or your secrets, then close the paths it used. Cloak Watch finds it; we fix it.

$4,500≈€4,000≈£3,400≈CA$6,400≈A$6,400≈S$5,800≈AED 16,500₹1,35,000flat

Answer within 48 hours

Hardening: $3,500–12,000≈€3,100–10,700≈£2,600–9,100≈CA$5,000–17,100≈A$5,000–17,200≈S$4,500–15,400≈AED 12,900–44,100₹1,05,000–3,60,000

AlsoWeb appAPIMobile appExternal networkInternal networkCloud configuration reviewSecure code reviewAll pentests

How a test works

  1. 1

    Scope and sign

    A free 30-minute call, then one fixed price in writing within a working day. Nothing is tested before you sign an authorization.

  2. 2

    AI covers everything

    Our tools and AI agents map every endpoint, role and AI feature in scope, and flag what looks wrong. Fast and wide.

  3. 3

    A person proves it

    A tester confirms each lead by hand, tests what AI misses (authorization, tenants and business logic) and records the evidence.

  4. 4

    Signed report, then retest

    A report and letter signed by Subcloak, a readout with your engineers, and a free retest once you've fixed things.

Headlines

Supply-chain attacks, written up properly.

What happened, who's affected, indicators of compromise and what to do. From the same signed feed Cloak Watch reads.

All headlines on headlines.subcloak.com

Why Subcloak

We test with the tools we build.

Most testing firms buy their tools. We write ours, use them on every engagement, and give them to developers for free. Each side makes the other better.

  1. Cloak Proxy01

    Captures your app's real traffic

    Every Proof Pentest replays it as every role and tenant. The result is the authorization matrix: who can see whose data, with the request as proof.

    Proof Pentest

  2. Cloak Watch02

    Spots a compromise on a developer's Mac

    From the same signed feed as our Headlines. When an attack reaches a team, the Dev Environment Check sweeps every machine and CI in 48 hours.

    Dev Environment Check

  3. Our tests03

    Feed what we learn back into the apps

    What we learn testing goes back into the apps developers get for free: Cloak Proxy's authorization matrix and its prompt-injection and MCP checks, and Cloak Watch's incident packs.

    Research

Research and blog

We publish what we learn.

Research Blog

Study · State of MCP Scopes

89%

of the hosted MCP servers using OAuth that we sampled (196 of 220) give a connected AI agent everything by default.

Read the first results

Pricing

Free apps. Fixed prices.

Every price is published. Tests are one fixed price agreed before we start, with a retest included.

Founding clients: Our first two AI Feature Security Test clients get 30% off in exchange for a named case study and a reference call. Open until 31 March 2027.

Full pricing

About Subcloak

A small security company in India. The person on your first call is the person who tests your system.

We work with teams worldwide, and schedule readouts at a time that suits yours. More about us.

Book a test hello@subcloak.com