Coverage
Custom Agents & SDKs
An agent with tools is an identity with credentials
Agents do not just answer — they act. They hold keys, call tools, reach databases and hand work to each other, with none of the joiner-mover-leaver process a human identity gets. SAF3AI instruments them, inventories what they can reach, and enforces policy on the calls they make.
What you see
The telemetry we pull
End-to-end agent traces
OpenTelemetry-native spans for every run: the prompt, each model round-trip, every tool call, the retrieval step and the final response — as one trace you can walk.
Tool and MCP inventory
Every tool and MCP server an agent can call, with the scopes attached. A write-capable tool is a different risk from a read-only one and the inventory records which is which.
Agent identity and credentials
Each agent as a non-human identity with the keys and roles it holds — the register that makes agent offboarding possible at all.
Retrieval and datastore reach
The vector stores, databases and documents an agent grounds in, which is what determines the blast radius of an injection.
Token cost per agent
Spend attributed down to the individual agent and run, so an expensive retry loop is attributable rather than a line on a bill.
Multi-agent handoffs
Where one agent passes work to another, which is exactly the edge a compromise propagates along.
How it connects
From zero to first signal
- 1
Add the SDK
A few lines in your agent's startup. Python and Node, with framework adapters for LangChain, CrewAI, Google ADK, LlamaIndex and AutoGen — around twenty-seven frameworks in total.
- 2
Or point OpenTelemetry at us
If your agents already emit OTEL, configure the endpoint and skip the SDK entirely. We are OTEL-native, not OTEL-compatible.
- 3
Register the tools and datastores
Mostly automatic from the traces. Anything the agent calls, SAF3AI records as an entity with its scopes — you only annotate what you want to classify explicitly.
- 4
Choose your enforcement point
Callback-level guardrails inside the agent, or route model calls through the AI Gateway for enforcement that survives a code change nobody reviewed.
- 5
Agents join the graph
Agents, tools, datastores and identities become graph entities, which is what turns "this agent has a write tool" into "this externally-reachable agent can write to customer data".
What it catches
Risks specific to this surface
Prompt injection into tool calls
Untrusted input that reaches an agent holding real capability. The graph shows which agents are externally reachable and what they can do once persuaded.
Over-scoped agent credentials
Agents given broad keys because narrowing them was harder. Every credential is inventoried with what it can reach.
Agent-to-agent propagation
One compromised agent riding a handoff into another. Correlation reconstructs the campaign as a single incident rather than several unrelated alerts.
Poisoned retrieval
Instructions planted in a vector store or knowledge base that steer every agent grounding in it, long after the document was ingested.
Secrets in prompts and outputs
Keys and tokens leaking through the model, detected by provider signature and entropy rather than a naive pattern match.
Agents nobody owns
Services still running after the team moved on, still holding credentials, still reachable. The inventory is what surfaces them.
See Custom Agents & SDKs in your own tenant
Connect this surface in a pilot and get a mapped inventory, a scored risk list and the attack paths that actually reach your data.