HAIEC establishes a three-layer open-source security portfolio for AI applications and agents

HAIEC’s open-source developer portfolio is organized around distinct, non-interchangeable risk surfaces: source-code patterns, tenant isolation boundaries and LLM input/output behavior. AI AppSec, MCP Tenant Isolation and LLMVerify bring inspection into development workflows without asking developers to accept opaque model-authored findings as conclusive security evidence.

AI AppSec provides a Semgrep-backed static inspection rulepack with 122 detectors covering 79 security checks. MCP Tenant Isolation focuses on cross-tenant disclosure and improper scoping patterns using 57 deterministic rules. LLMVerify focuses on model I/O and common runtime-content risks. The packages are independently usable; some use different execution environments and have separate limits.

Publishing focused developer packages establishes transparent engineering artifacts that teams can inspect, reproduce and incorporate into their workflows. HAIEC’s enterprise assurance platform remains distinct: it reconciles capability, permission, authorization and qualified observations across the wider action lifecycle. The packages demonstrate the company’s commitment to the foundations that assurance ultimately depends on.

AI AppSec inspects source code and finds configured patterns relevant to AI applications and agents. MCP Tenant Isolation analyzes selected cross-tenant exposure risks around request context, resources and shared state. LLMVerify examines configured model input and output conditions during application execution. Each tool is aimed at a different evidence surface.

Keeping these responsibilities separate prevents a common mistake: treating a green scanner report as proof that a system’s entire behavior is authorized and safe. An application can pass a static check but still return inappropriate content at runtime, or a clean model response can mask a poorly scoped tenant data query.

The packages are released through public source repositories with documented usage, rules and limitations. Developers can inspect implementations and selectively integrate the relevant check into a local workflow or CI process. This enables adoption without an immediate requirement to buy an enterprise assurance platform.

The tool family is deliberately modular. A team operating a multi-tenant MCP service may prioritize isolation analysis, while a model-facing product may focus on runtime I/O. Results remain bounded to the selected rules and the inputs assessed.

The next question for security and governance leaders is what to do with technical findings when an AI agent can create records, move data, send messages or change infrastructure. HAIEC’s enterprise approach reconciles evidence with authority and consequential capability rather than asking a single scanner to answer all those questions.

Open-source development provides a transparent technical record and a useful point of entry for practitioners. The larger commitment is to disciplined, inspectable assurance across the lifecycle of consequential AI systems.