SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Traceforce Offers Device-Level Security Monitoring for Enterprise AI Apps and MCPs

0
·1 views

Traceforce, founded by Xia and Varun and backed by Y Combinator (S26), is a security platform that gives companies visibility and control over AI applications such as ChatGPT and Claude running across employee devices. The tool installs as a lightweight binary and browser extension, surfacing live data on AI app activity to a security dashboard within 30 minutes. It also tracks how those apps connect to external data sources via Model Context Protocols (MCPs), and includes an open-source MCP pentesting tool called mcp-xray. The platform is currently deployed on over 1,000 devices across 10 organizations, where it has helped detect exposed secrets, prevent API key leaks, and flag potentially destructive commands before execution. Traceforce processes content locally on-device and does not store user prompts unless explicitly enabled by an organization's security administrators.

Read the full story at Hacker News

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Why Netflix Screenshots Show a Black Rectangle: The Android Architecture Explained

When users screenshot Netflix or banking apps on Android, they see a black rectangle — not because anything is censored, but because the video layer was never included in the capture. Android's compositor, SurfaceFlinger, renders separate image outputs for the screen and the screenshot service, skipping any layer marked with FLAG_SECURE during capture. The resulting black area is simply zeroed memory that was never written to, meaning no active blocking or detection takes place. Developers can apply this protection to any app window with a single line of code using WindowManager's FLAG_SECURE flag. However, the protection is software-enforced and can be bypassed on rooted devices, unlike Widevine L1, which stores decoded frames in a hardware-level secure enclave.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer builds lightweight self-hosted observability tool for LLM agents

A developer frustrated with the opacity of small LLM agent runs built an open-source observability tool called Otterscope after finding existing solutions either too invasive or too complex. Otterscope is distributed as a single Go binary that stores data locally in SQLite and listens for OpenTelemetry traces, requiring no external databases or cloud services. The tool tracks costs against current provider pricing and keeps evaluations in the same database as traces for easy correlation. It currently operates as a single-user tool with no authentication, and can be run via Docker or self-hosted on a basic cloud server for around six dollars a month. The project is available on GitHub and is aimed at individual developers who want simple, private visibility into their agent behaviour.

0 comments Read more at DEV Community
0
ProgrammingHacker News ·

Activists claim acid attack sabotaged Microsoft hyperscale data centre construction

A group of activists has claimed responsibility for using acid to sabotage the construction of a Microsoft hyperscale data centre. The incident was reported by Dutch tech workers' platform Techwerkers.nl. The sabotage appears to be motivated by opposition to the expansion of large-scale AI and cloud infrastructure. Details about the exact location, timing, and extent of the damage remain limited based on available information.

0 comments Read more at Hacker News
0
ProgrammingDEV Community ·

Developer learns to trust live data over stale markdown files after AI agent misstep

On May 21, a solo developer discovered his AI agent incorrectly reported four articles as unpublished, when they had actually gone live days earlier. The agent was not at fault — it had faithfully read a backlog.md file that the developer had simply forgotten to update after recent deployments. The incident highlighted a common failure mode in solo projects: documentation files drift out of sync with actual system state when no automated refresh mechanism is in place. The developer now runs four shell commands at the start of each session to read live data directly from git logs, file system state, and API outputs before consulting any markdown file. He treats any summary document without a declared update mechanism as stale cache, not a reliable source of truth.

0 comments Read more at DEV Community