Application Security & Non-Human Identity (NHI)
TrustIvan
Code, Container & Machine-Identity Security in One Place
Most breaches now start with a vulnerable dependency or a leaked machine credential. TrustIvan covers both: Trivy-based scanning of images, packages, and SBOMs, plus discovery and rotation of non-human identities such as service accounts, API tokens, CI/CD bots, and MCP tool servers. Triage decisions are stored against the finding rather than the image, so an accepted risk stays accepted after the next rebuild and the next scan.
Key metrics
Design targets and benchmarks, validated with each customer during a pilot.
Capabilities
Container & SBOM Scanning
Trivy-based inspection of base images, layers, OS packages, and language dependencies, with persistent triage so accepted risks do not reappear on every scan.
Non-Human Identity (NHI) Governance
Discovers service accounts, tokens, cloud credentials, and CI/CD runners, flags unused or over-privileged ones, and automates rotation.
AI Agent Runtime Authorization
Policy checks on every tool call an LLM agent or MCP server makes, so an agent can reach only the systems its task needs.
Fix Pull Requests
Opens pull requests with dependency and base-image upgrades, so findings arrive as reviewable changes instead of tickets.
Supply Chain Attestation
Signs container images and SBOMs with Cosign and in-toto attestations so provenance can be verified at deploy time.
Secret Detection in CI/CD
Scans pull requests and commits for exposed API keys, private keys, and cloud service tokens before they merge.
Architecture
- Go API with a NestJS service for non-human identity discovery
- Single sign-on and multi-tenant isolation
- Trivy scanning engine, run in CI or against registries
- Runtime policy gateway for MCP and agent tool calls
Business Outcomes
- Reduces token and secret sprawl across repositories and pipelines
- Maps findings to NIST SSDF, CIS Benchmarks, and Executive Order 14028 SBOM requirements
- Lets AI teams ship agents without handing them broad credentials
Who It's For
Chief Information Security Officer (CISO)
One inventory of machine identities and container supply-chain risk, with evidence ready for auditors.
VP of Platform / DevOps Lead
Scans that run inside CI in seconds and arrive as fix pull requests, not ticket backlogs.
AI Platform Architect
Agents call internal tools under explicit, auditable policy instead of shared admin credentials.
Integrations
- Docker
- Kubernetes
- GitHub Actions
- GitLab CI
- AWS ECR
- Google Artifact Registry
- Trivy
- Cosign
Works With
Enterprise AI & Agent Orchestration
MITHUNAI
Private AI assistants and multi-agent workflows that cite their sources
Observability & AI-Ops
aiAxonIQ
OpenTelemetry logs, metrics, and traces on ClickHouse, with anomaly forecasting and plain-English queries
Open-Source Continuous Compliance (GRC)
trustlynce
Open-source compliance automation with 270+ MCP tools for evidence, controls, and audits