AG10Govern AI agent scope
Agent supply-chain governance
Control what your agents are allowed to install: MCP servers, skills and plugins, each on an allow-list, checked for provenance and pinned.
Price on requestAsk about AG10How pricing works
What it is for
Agents extend themselves with MCP servers, skills and plugins, often installed by one engineer in one command. Each is code that runs with the agent’s authority. AG10 puts a gate in front of them.
Why it matters
- A malicious package posing as a legitimate MCP server was found in September 2025 copying every email sent through it to an attacker.[1]
- Agent frameworks themselves carry vulnerabilities: a March 2026 research note described actively exploited flaws in widely used frameworks, from remote code execution to serialization injection and path traversal, and advised upgrading and auditing installed versions, including transitive dependencies.[2]
- Skills are now a shared open format, hosted with MCP and AGENTS.md by the Agentic AI Foundation,[3] which makes them easy to share and easy to share badly.
What we build with you
An allow-list with an owner for each entry, provenance checks before anything is added, a review workflow light enough that engineers use it, and a pinning and patching policy. Components are recorded in your bill of materials, so S4 AI supply chain and AG10 tell the same story. OWASP lists the risk as ASI04 Agentic Supply Chain Vulnerabilities.[4]
Framework mapping
The frameworks this scope is aligned with, the version we map to, and what we map. Aligned with means we use the framework; it does not mean any body has certified TriOngle.
| Framework | Version | What we map |
|---|---|---|
| OWASP Top 10 for Agentic Applications | 2026 edition, 9 Dec 2025[5] | ASI04 Agentic Supply Chain Vulnerabilities |
| CoSAI Model Context Protocol security taxonomy | 27 Jan 2026[6] | Supply-chain threats to MCP |
| CycloneDX 1.7 | 1.7, 21 Oct 2025[7] | Recording components in a bill of materials |