After a supply-chain attack
When the next npm, PyPI or AI-agent supply-chain attack hits, know within 48 hours whether it reached your developers' Macs, your CI or your secrets, then close the paths it used. Cloak Watch finds it; we fix it.
What you get
For: CTOs and platform leads at teams of 10 to 200 engineers, especially teams with many AI agents and MCP servers.
Cloak Watch on a developer's Mac, with sample data. It's free, and reads the same signed feed as our Headlines.
Three ways to buy it
Response
Within 48 hours of the go-ahead: a sweep of developer Macs and CI for the incident's indicators, a review of lockfiles, CI logs and outbound traffic, a secret-rotation runbook, and a signed letter.
$4,500≈€4,000≈£3,400≈CA$6,400≈A$6,400≈S$5,800≈AED 16,500₹1,35,000flat
Hardening
Editor extensions, packages, AI coding agents and their permissions, MCP servers, .npmrc and publish tokens, GitHub Actions pinning and permissions, and package cooldowns, with a backlog in priority order.
$3,500–12,000≈€3,100–10,700≈£2,600–9,100≈CA$5,000–17,100≈A$5,000–17,200≈S$4,500–15,400≈AED 12,900–44,100₹1,05,000–3,60,000
Retainer
$750≈€670≈£570≈CA$1,100≈A$1,100≈S$960≈AED 2,800₹25,000/ month
Billed monthly
How it runs
1
A free 30-minute call, then one fixed price in writing within a working day. Nothing is tested before you sign an authorization.
2
Our tools and AI agents map every endpoint, role and AI feature in scope, and flag what looks wrong. Fast and wide.
3
A tester confirms each lead by hand, tests what AI misses (authorization, tenants and business logic) and records the evidence.
4
A report and letter signed by Subcloak, a readout with your engineers, and a free retest once you've fixed things.
FAQ
Something else? Email hello@subcloak.com or book a call.
Book a call or email us with the advisory you're worried about. The 48 hours start once the authorization is signed and we have access to what's in scope.
It makes the sweep faster and leaves you with something that keeps watching, but it isn't required. Cloak Watch is free and runs on Macs; for Linux and Windows machines and CI we check by hand and with scripts.
Findings in writing, a secret-rotation runbook, and a signed letter saying what was affected or that nothing was, for your customers, auditors and insurer.
Other tests
For SOC 2, ISO 27001 and enterprise deals
AI covers your whole web app and API in days. Then a person tests every role and tenant by hand, proves each finding, and signs the report your auditor and customers will accept.
$4,900–9,500≈€4,400–8,500≈£3,700–7,200≈CA$7,000–13,500≈A$7,000–13,600≈S$6,300–12,200≈AED 18,000–34,900from ₹95,000
Report in 5 working days
For copilots, chat, RAG, agents and MCP
Can your AI feature be talked into leaking another customer's data, or into using its tools in ways you never meant? We test it the way attackers do, prove the answer, and sign it.
$6,500–18,000≈€5,800–16,100≈£4,900–13,600≈CA$9,200–25,600≈A$9,300–25,800≈S$8,300–23,000≈AED 23,900–66,100₹1,50,000–3,40,000
Added to a Proof Pentest: $2,500≈€2,200≈£1,900≈CA$3,600≈A$3,600≈S$3,200≈AED 9,200₹75,000
Thirty minutes, no slides. Tell us what you need tested and when you need the report. You'll have one fixed price in writing within a working day.