App and agent security
Runtime security, auth, secrets and permissions for apps and agents. 5 resources; API, key, license and embedding quoted from each site's own pages, checked Oct 24, 2026.
ClawSecure
Before you let a third-party skill or MCP server touch your files and keys, you can look up or run an audit and have your agent check a clearance verdict and content hash in one API call.
API, no keyFree tierLicense unclear
AEVS (Agent Execution Verification System)
A model saying it refunded a customer is not proof; AEVS gives you a checkable record of which tool ran, with what inputs and output, without changing your tools.
APIOpen sourceLicense unclear
Arcjet
You add bot blocking, rate limits and prompt-injection checks as a few lines inside a route handler or agent tool call instead of putting a proxy or WAF in front of the app.
APIFree tierCommercial: conditions
DCP (Delegated Custody Protocol)
Agents can sign, pay or call an API without ever reading the raw key from a .env file, and anything over a limit waits for your approval on desktop, Telegram or phone.
Open sourceFree tierCommercial OK
MonoCloud
You add login, sessions and API token checks to an app with an SDK instead of building password storage, social providers and passkeys yourself, and the free plan covers up to 50,000 monthly active users.
APIFree tierCommercial OK
Side by side
| Resource | API | Key | Data download | Commercial use | Embed |
|---|---|---|---|---|---|
| ClawSecure A scanner that checks AI agent skills, MCP servers and CLI tools (from a GitHub link, ClawHub URL or zip) for malicious code, prompt injection and supply-chain risks before you install them, with a public audit registry and a clearance API; paid runtime monitoring is on a waitlist. |
Official API · Free | No | — | Commercial use unclear | Embedding unclear |
| AEVS (Agent Execution Verification System) A Python SDK plus hosted backend that records every tool call a LangChain/LangGraph or MCP agent makes as a signed, hash-chained receipt, which anyone with the receipt ID can check through a public API or explorer. |
Official API | Yes | — | Commercial use unclear | Embedding unclear |
| Arcjet A security SDK plus cloud decision API that you call from your own code (JS/TS, Python, Go) to rate-limit, block bots, validate emails, run a WAF, detect prompt injection and redact PII, with hooks to allow or block coding-agent and MCP tool calls. |
Official API · Free tier | Yes | — | Commercial use with conditions | Embedding unclear |
| DCP (Delegated Custody Protocol) A free, open-source desktop app and MCP permission server that keeps Solana wallet keys, API credentials, identity details and private data in a local encrypted vault and lets each AI agent use them only within per-agent rules, spending caps and approvals. |
No official API | — | — | Commercial use OK | Embedding unclear |
| MonoCloud A hosted sign-in and user-management service with branded login pages, social login, passkeys, magic links, groups and machine-to-machine tokens, plus SDKs for Next.js, React, plain JS, Node (Express/Fastify) and ASP.NET Core and a management API. |
Official API · Free tier | Yes | — | Commercial use OK | Embedding with conditions |