SEGMENT 01 · AGENT FLIGHT CHECK · BOOKING NOW
Know what your agents are doing. In two weeks.
Every company now has agents acting on production systems — coding agents, MCP servers, internal automations — and almost nobody has the list. Agent Flight Check gives you the list, the permissions behind it, and ten days of tamper-evident records of what those agents actually did.
THE OFFER
Two weeks. One price. Evidence you keep.
A fixed-scope diagnostic with a named deliverable and a date on it. No platform licence, no per-seat fee, no data hosted by us.
FIXED PRICE · CREDITED AGAINST A BUILD$7,500 for the full Flight Check.
Credited in full against a remediation build signed within 60 days. If the report says nothing needs fixing, you paid for a clean bill of health with the evidence to prove it.
- SCOPE / One organisation, up to twelve agent or MCP endpoints in the first pass
- ACCESS / Read-only proxy inside your boundary; no credentials leave your network
- OUTPUT / Inventory, permission map, evidence export (JSON), findings report, remediation plan, readout
- TIME / Fourteen calendar days from install to readout
WHAT YOU GET
Six things, all of them yours.
Delivered as files you own, in formats engineering already reads. Nothing is locked behind a login on our side.
01
Agent & MCP inventory
Every agent, model, MCP server, connector, and tool acting in scope — including the ones nobody remembers installing.
02
Permission map
What each one can read, write, publish, purchase, or never touch — and who approved it, and when.
03
Ten days of records
Agent actions recorded inside your boundary as a hash-chained, tamper-evident timeline. Read-only. Nothing leaves your network.
04
Findings report
Risks, coverage gaps, and reliability failures — ranked, with the evidence that supports each finding.
05
Remediation plan
What to fix, in what order, with a build estimate engineering can act on the same week.
06
Leadership readout
Sixty minutes with your engineering and security leads. Questions answered from the record, not from slides.
HOW IT RUNS
Install. Record. Read out.
Two weeks is long enough to catch the weekly cadence of your agents and short enough that the answer arrives while the question is still live.
WEEK 1Install and interview
Witness is installed as a transparent proxy in front of your MCP servers and agent runtimes. We interview the owners of each agent and reconstruct the approval history.
READ-ONLY UNTIL YOU SAY OTHERWISEWEEK 2Record and analyse
Ten days of live traffic accumulate. We correlate actions against permissions, reconcile the inventory, and draft the findings.
READ-ONLY UNTIL YOU SAY OTHERWISEDAY 14Readout
Report, remediation plan, and evidence export delivered. Readout call with leadership. You keep the recorder running or switch it off.
READ-ONLY UNTIL YOU SAY OTHERWISE WHO IT'S FOR
Agent sprawl with a name on it.
The Flight Check is built for the person who will be asked, in a board meeting or an incident review, what the agents did — and has to answer from evidence.
YOU RUN
Claude Code, Codex, Cursor, or internal agents against production systems, and more than one team owns them.
YOU ARE
A 150–2,000-person software company — VP Engineering, Head of Platform, or CISO — being asked what the agents are doing.
YOU NEED
A defensible inventory, an evidence trail for the next incident, and a plan — not another vendor dashboard.
THE INSTRUMENT · WITNESS
Open-source, local-first, cross-vendor.
The Flight Check runs on Witness — DVC's agent flight recorder. A transparent MCP proxy that writes tamper-evident, hash-chained records of every agent action, with explicit coverage manifests so it never overclaims what it saw. Apache-2.0. Complete for one engineer for free; the Flight Check is where an organisation buys the reading of it.
- RECORDS / Operator, target, action, policy result, expiry, nonce — every entry chained to the last
- COVERAGE / Observed, absent, unreachable, unsupported, and unconfigured scope are all declared
- CONTROL / Read-only by default; suspend and terminate contracts fail closed and require explicit approval
- VENDORS / Not locked to one model provider, one IDE, or one cloud
Witness on GitHub ↗AFTER THE READOUT
The report is the beginning, not the invoice.
A diagnostic that ends in a PDF is expensive homework. Every Flight Check ends with a costed path to fixing what it found — and you can take that path with us or without us.
BUILD · $50–200K · 4–12 WEEKS
Fix what the record found.
Permission boundaries, approval gates, agent contracts, and the evidence pipeline — built in your environment, owned by you. The $7,500 comes off the top.
OPERATE · FROM $5K / MONTH
Keep the recorder running.
Continuous recording, monthly findings, and a human who reads the chain before your auditor does.
TWO WEEKS · $7,500 · NOTHING LEAVES YOUR NETWORK
Book the readout call.
Thirty minutes to confirm scope and dates. If the Flight Check isn't the right instrument for your estate, we'll say so on the call.
Book the readout call →