The largest live trust scan of the agent skill ecosystem.
23,691
skills indexed
~10,000
scanned (42%)
120
revoked · trust zeroed
149
vulnerable flagged
3,479
perfect trust score
Source safety
ClawHub7,452
96.7%
GitHub1,081
99.2%
MCP Registry959
99.7%
Revoked = excluded from search. 0 leaked.
Top vulnerabilities
CWE-94
93Code Inj.
CWE-79
69XSS
CWE-22
40Path Trav.
CWE-78
34OS Cmd
All CRITICAL. + 41 prompt injection.
vs. public reports
Cognium~10,000
AgentAudit194
BlueRock7,000
Enkrypt AI1,000
3 sync pipelines on cron. Growing while you read this.
50x more scanned than the next largest audit.
Registry Traction
6 / 12
Market
Starting with US software development. Where the proof gap is widest.
US developer funnel (conservative)
The spending gap
$20–100
/mo on coding agents
$0
/mo proving what agents did
Conservative US TAM
$324M
900K x $30/mo x 12
US = 67% of deployed agentic systems. EU AI Act (Aug 2026) creates pull for global expansion. Software delivery first — every new agent surface expands the TAM.
US Market
7 / 12
Product
Start with one command. Scale to full governance.
Phase 1 · Now
Building
CLI + CI/CD Gate
$ npm install @cognium/controldeck
$ cognium scan ./my-agent
✓ Trust score: 92 · 0 findings · Author-Verified
Scan from terminal. Add as GitHub Action. Trust report on every PR.
Phase 2 · Next
Conversation + BYOA
Architect refines intent in conversation. System augments into Specifica. Tasks decompose. Context hands off to any coding agent via API.
Phase 3 · Horizon
Progressive Autonomy
L1 hard-stop to L3 autonomous. Six-gate pipeline. Routines become skills. Less human oversight every cycle.
Spec standard
Specifica — open at specifica.org. The spec is a runtime artifact, not a planning artifact.
Autocomplete. Suggestions. Human authors everything.
2025–2026
Agents author
Claude Code, Codex, Cursor. Autonomous issue-to-PR.
Aug 2026
EU AI Act enforced
Spec compliance legal. Fines to EUR 35M / 7%.
Ecosystem proof
ClawHub: 21K+ skills. 1,184 malicious. 30 MCP CVEs in 60 days. 36.7% of MCP servers exposed to SSRF.
Developer appetite
Spec Kit: 72.7K stars. Kiro in GovCloud. 40% of enterprise apps embedding agents in 2026.
The window
The moment agents became authors, the proof gap opened. Scanning commoditizes in 18 months. The standard-setting window is now.
Why Now
9 / 12
Capability Matrix
Built for the AI era.
Semantic SAST
Trust Score
Spec vs Code
Auto Pipeline
Agent-Agnostic
Cognium
SAST + LLM
0–100 tiered
Semantic diff
L1 → L3
Any agent
Claude Code Review
LLM
—
—
—
Anthropic
Copilot Review
LLM
—
—
Rule-based
GitHub
Kiro (AWS)
—
—
At generation
—
AWS
Snyk
Pattern
Adding
—
—
N/A
CodeRabbit
LLM
—
—
—
N/A
Greptile
LLM + graph
—
—
—
N/A
AgentAudit
LLM (3-pass)
0–100
—
—
Open
Coding agents (Claude Code, Copilot, Cursor, Codex) are the execution layer. Cognium is the trust layer above.
Competition
10 / 12
Why Us
Why this team. Why now.
Founder
25 years in compilers and static analysis
Neuro-symbolic engine built from first principles. SAST + LLM is the technical moat.
Data moat compounds
23,691 skills. Growing every 10 minutes.
Every scan adds trust data. The dataset compounds with usage.
Governance IP compounds
Domain knowledge becomes defensible.
Partners encode compliance rules, regulatory patterns, and governance workflows as verified skills. Their private registry grows with every engagement — IP that only they own.
Agent-agnostic
Works with every coding agent
Claude Code, Copilot, Cursor, GitLab Duo, Codex. Architect keeps their tools. Cognium is the trust layer.
Timing
Standard-setting window is open
Scanning commoditizes in 18 months. The winner defines trusted agent software.