Traceforce

• The endpoint platform vendors whose sensors already run on these devices could add AI-tool and connector discovery as a feature, which would remove the separate budget line before Traceforce lands named accounts.
• The one write-up of Traceforce code that the record does not tie to the company is a tutorial on the free scanner. If no such account of the paid product appears through 2026, buyer pull is weaker than the published content suggests.
• Traceforce publishes no named customer reference, and its own customer-stories page returns a 404, so its deployment claims cannot be checked against an identifiable account.
• Fetched sources disclose no backing beyond the Summer 2026 Y Combinator batch. If Traceforce announces no priced round and shows no visible team growth within a year, it will struggle to fund the enterprise sales motion its per-device pricing implies.
• Traceforce now blocks tool calls on developer machines rather than only recording them. A publicized block that stops legitimate work would push buyers to run it in warn-only mode, which is the setting an incumbent sensor can match most easily.

Traceforce aims at AI activity that network-layer controls can miss, because the consequential action starts on the device. The company states the gap on its platform overview page, saying that rivals work through enterprise APIs, gateways, or EDR and CASB extensions while Traceforce operates on the device, and the founders make the same argument in their July 2026 launch post, that the risky action happens on the laptop before anything crosses the wire. The assets in question are the AI assistants, coding agents, connectors, and skills that employees install themselves, often without review.

The buyer is the enterprise security team facing employee-installed AI. In a Traceforce-sponsored writeup, Ken Huang describes approved AI tools coexisting with unapproved local setups and experimental scripts, and he argues that standard software inventory misses agents that make decisions and call tools at runtime. A local assistant may hold connections to the filesystem, a shell helper, code repositories, and internal documents, so one unsanctioned assistant can reach files, shells, and repositories at once.

Corroboration beyond the vendor's orbit is the weak spot. Both practitioner writeups that discuss Traceforce are vendor-sponsored, the podcast appearance and the two July 2026 launch posts are the founders' own, and no fetched source puts the pain in dollars or incident counts. The problem statement is specific and current, and the reviewed record carries no public test of it by a buyer the vendor did not bring. [s19, s1, s20, s11, s12, s9]

The product's first job is discovery. The Scout sensor inventories the AI agents, MCP servers, and skills present on each device, and the documentation describes tracking down to the agent's plan tier and underlying model, since personal and enterprise plans differ in the security controls they include. A browser extension extends discovery into Chrome and Edge, with a documented deployment path through Google Workspace management, and the quickstart lists the sensor on macOS Sequoia and Tahoe and on Windows 10 and 11 as of July 2026.

Traceforce now sells enforcement alongside discovery. The homepage says Traceforce tracks every tool call from connectors to command-line agents and stops dangerous actions from running, detects and quarantines a malicious connector, and patches AI packages on the device with policy and audit logs rather than remediation scripts. The fetched record carries no independent account of how those controls behave in a customer fleet, so their effect stays vendor-reported.

Traceforce also scores what it finds. The Atlas registry assigns security ratings to hundreds of known agents and to a connector catalog the vendor counts differently by page, with the GitHub README stating over 600 MCPs, the Scout docs describing deep inspection of over 500, and the homepage counter showing 1K+ MCPs curated. The docs cover default and custom policies that pair target risk scores with remediation actions, and the product surfaces policy violations as issues with automated responses.

Container visibility is the most distinctive documented capability. The docs include a sandbox setup guide for AI-assistant monitoring inside containers, and the sponsored demo writeup details the mechanism, with a Scout Lite agent auto-installed in dev containers because host-level EDR sees only the Docker daemon rather than the agent processes and MCP servers inside.

Traceforce backs the marketing site with public engineering artifacts. MCP X-Ray is an Apache-licensed open-source scanner, written in Go, that checks connector configurations for exposed secrets, unsafe connections, and risky tool descriptions, and emits SARIF reports for CI pipelines. A July 2026 tutorial on a non-vendor site documents its configuration scan, penetration test, and repository scan commands and its SARIF output format, carrying no Traceforce sponsorship disclosure, unlike the practitioner writeups the vendor paid for. The GitHub organization also hosts a Terraform provider and a Go SDK, and the docs portal publishes an API reference. [s4, s5, s6, s7, s8, s12, s1, s15, s16, s18, s19, s25]

Traceforce positions against the tools enterprises already own rather than against named rivals. The platform overview page claims that rivals working through enterprise APIs, gateways, or EDR and CASB extensions miss AI running on the device, and Ken Huang's sponsored shadow-AI writeup extends the argument to SIEM, DLP, CSPM, and network analysis, tools he says were not designed to inventory or govern agents on devices.

Absorption by an endpoint platform is the threat that matters most. Those vendors already deploy sensors to the kind of devices Traceforce instruments, so they could attempt the same discovery and blocking through an agent already on the endpoint, and no fetched source shows one doing it yet. Traceforce's visible counters are container-level discovery, which the sponsored demo writeup says host-level EDR does not perform, and the curated Atlas risk registry, and no fetched source shows either one being hard to replicate.

Category vocabulary is still settling. The site sells an AI security and control platform for devices while the sponsored coverage coins agentic security posture management for the same slice, and buyers must decide whether this capability is a new budget line or a feature of endpoint tooling they already pay for. Analysts could define the emerging category around endpoint specialists, which would favor Traceforce, or buyers could file the capability under platforms they already own, which would not. [s1, s11, s12, s19]

Traction is told almost entirely in the founders' own voice. On a podcast published in July 2025, CEO Xia Hua described speaking with about two dozen design partners and landing the company's first customer roughly a month before the recording, about four months after founding. The July 2026 launch posts carry the current figures, more than 1,000 devices at 10 organizations in the Hacker News post and 1,500-plus devices across five enterprises in the Y Combinator launch eleven days later, with the closest thing to a reference quoted as a database provider of more than 500 employees.

No fetched third-party source names a Traceforce customer. The site's navigation offers a Customer Stories page, and that page returns a 404, so the vendor's own reference collection is not published either.

Traceforce sells founder-first over a self-service entry point. The founders front the public storytelling through the podcast, the launch posts, and the company site, the site offers a free trial covering ten devices for thirty days with no credit card, and Traceforce appears on the partner listing for the Cyber Security & Cloud Congress North America event. No go-to-market hire appears in the reviewed record, so the sellers it names are the founders themselves.

Open source is the other channel bet. MCP X-Ray gives practitioners a free scanner that can upload results to the hosted Atlas service, a classic tool-to-platform funnel, and the repository was still taking commits in late July 2026. A tutorial on a non-vendor site walked through its commands in July 2026 with no sponsorship disclosure on the page, the one write-up in the reviewed record that Traceforce is not shown to have arranged. [s9, s20, s22, s26, s1, s16, s7, s13, s24, s25]

The founders come from data protection rather than endpoint security, and nothing in the reviewed record shows either of them having shipped an endpoint agent before the one they now ask enterprises to install. CEO Xia Hua was director of engineering at Clumio and built in-memory databases at Oracle before that, a career she and the hosts walk through on the July 2025 podcast, where she also references her MIT background in passing. The Y Combinator launch page describes the pair as the engineers who ran Clumio's engineering organization, with Xia as director of engineering and her co-founder as tech lead.

The Clumio chapter is the strongest verifiable credential. Commvault announced in September 2024 that it would acquire Clumio, calling it a technology leader in data protection for critical cloud data in AWS, so a public acquirer moved to buy the company the founders came from. The cited record identifies their Clumio roles as employees and documents no prior founder outcome for either name.

Who the second founder is remains unsettled in the public record. The July 2025 podcast listing names Xia Hua and Glenn Mulvaney, the July 2026 launch post introduces the founders as Xia and Varun, and the About page lists Xia Hua and Daniel Seixas, each carrying the title co-founder and CEO. The conflicting founder records leave a material diligence question open for a fleet-wide sensor deployment.

The reviewed record names no employee beyond the founders. They describe leaning on advisors who have sold companies before, and the contact page lists a San Francisco address. Public evidence of bench depth beyond the founders is thin, and the fetched GitHub pages identify no contributor roster and no named maintainer of the endpoint sensor, so the reviewed record leaves the sensor's upkeep unattributed. [s9, s10, s14, s21, s22, s23, s2, s7]

The public trust posture is more formal than the company's stage would suggest. Traceforce displays the same two badges on its homepage and under the Legal and Compliance header on its legal page, and they render as ISO 27001 and AICPA SOC 2 Type 2, the standard report type an enterprise buyer asks for. The legal page also publishes a vulnerability disclosure policy, free-trial terms of service, a data processing addendum, a privacy policy, and a mutual NDA, so the documents a procurement reviewer asks for first are present.

What the badges assert is not yet checkable. The rendered legal page carries the pair with no auditor name, no scope statement, and no reporting period, and the trust center at traceforce.trust.cyberbase.ai puts its View audit documents control behind a sign-in, so a reviewer who wants to know what the SOC 2 covers has to contact the company for it.

Deployment controls match enterprise expectations on paper. The docs cover SSO configuration, Jamf Pro and MDM integration, and a storage-provider option that keeps scan data in the customer's own cloud storage. For a product that watches employee devices, customer-controlled storage addresses part of the data-sensitivity concern.

The counterparty itself is the remaining trust question. Traceforce is a young company whose backing in the fetched record is an accelerator batch with no priced round, and it asks enterprises to install a sensor on every endpoint, a dependency security reviewers weigh heavily when they assess vendor viability. Named references or a disclosed round would shorten that conversation. [s1, s17, s28, s3, s27, s4, s21]

Add analyzed competitors to compare them side by side with Traceforce.

Traceforce aims its messaging at enterprises while its packaging serves small deployments first. The homepage claims trust from companies that power the Fortune 500, yet the visible entry path is a free trial capped at 10 devices for 30 days that requires a Google or Microsoft Workspace email, with an unlimited enterprise version behind SSO setup. The economic buyer is the security leader accountable for AI activity on employee devices, and the deploying persona is the IT administrator pushing MDM policies.

Documented platform support covers both major desktop estates as of July 2026. The quickstart lists Apple Silicon and Intel macOS on Sequoia and Tahoe, Windows 10 and 11 on arm64 and x86, and the Chrome and Edge browsers at version 138 and above. The documentation no longer supports scoping the addressable buyer to Mac-and-Chrome technology estates. Linux endpoints stay undocumented and no fetched page describes how mature the Windows coverage is, so a buyer with a mixed estate cannot tell from the documentation which parts of its fleet Traceforce covers to the same depth.

Named-customer evidence has not appeared since the founders' July 2025 podcast, which described two dozen design-partner conversations and one unnamed first customer. The current demand signals are the two July 2026 founder posts, one reporting 1,000-plus devices at 10 organizations and the other 1,500-plus devices across five midsize enterprises (s27, s28), both vendor-reported and unnamed, with a reference quoted only as a database provider of more than 500 employees.

The reviewed record traces every account of that demand back to the company. The two launch posts are the founders' own, the earlier SDK announcement is the company's (s20), the April and May practitioner writeups are sponsored, the conference listing carries the vendor's own positioning line, and the site's own customer-stories page returns a 404 (s32). The pitch tracks the current agent and connector generation, and Traceforce has published no buyer-side evidence to match it.

The claimed pain points are specific, and the documentation shows the mechanisms Traceforce built against them. Traceforce names unseen AI tools, agents, MCP servers, and skills on devices as the problem, and the docs show the mechanism, with Scout detecting over 100 publicly known desktop and browser agents, deep inspection of ChatGPT Desktop, Claude Desktop, Cursor, Windsurf, Claude Code, and VS Code, and discovery plus deep inspection of over 500 known MCP servers. Tracking extends to the agent's plan tier and underlying model, since plan levels differ in the security controls they include.

Container discovery is the most differentiated documented capability. The docs include a sandbox guide for monitoring AI assistants inside containers, and the sponsored demo writeup explains why it matters, since host-level EDR sees the Docker daemon rather than the agent processes and MCP servers inside. It is also the claim most worth independent verification, which no fetched source provides.

Traceforce's accumulated data sits per customer in the fetched record. The Atlas registry carries curated security ratings, and the vendor's own pages count its size three ways, with the GitHub README stating over 600 MCPs, the Scout docs describing deep inspection of over 500, and the homepage counter showing 1K+ MCPs curated.

TraceGraph builds a real-time AI activity graph from the telemetry of agents on each customer's endpoints, exposed through a TraceGraph Agent SDK that lets customers build on that data engine. The fetched record describes a per-customer design, and while X-Ray results can upload to the hosted Atlas registry (s11), no fetched source documents telemetry pooled across customers into a flywheel. Where the product applies AI, such as X-Ray's LLM-generated pentest plans and its optional LLM analyzer, it consumes third-party frontier models rather than proprietary ones.

Traceforce now sells runtime control alongside discovery. The homepage states that Traceforce tracks every tool call from connectors to command-line agents and stops dangerous actions from running, detects and quarantines a malicious connector, and patches AI packages on the device with policy and audit logs instead of remediation scripts (s1). A homepage counter puts the rate at 10K dangerous actions blocked per second (s23), and no methodology, independent benchmark, or customer-fleet result in the fetched record substantiates that number or shows how the block and warn rules behave in a live estate.

External validation is the standing gap on the commercial product. The third-party capability writeups are Traceforce-sponsored, and the founders' podcast was a Traceforce-focused founder appearance rather than an independent review. One July 2026 tutorial on a non-vendor site comes closest to an exception, documenting the scanner's configuration scan, penetration test, and repository scan commands and its SARIF output format, and carrying no Traceforce sponsorship disclosure (s31). No independent evaluation, benchmark, or customer technical writeup of the paid platform appears in any fetched source.

Traceforce sells founder-first over a self-service entry point. The founders front the public storytelling through a podcast appearance, LinkedIn activity, and a partner listing on the Cyber Security & Cloud Congress North America site, and no go-to-market hire is visible in any fetched source. Their own account is sell-first, with two dozen design-partner conversations coming before any product commitment.

Self-service is real but gated. The trial provisions 10 devices for 30 days and requires a Google or Microsoft Workspace email, so Traceforce filters for organizational buyers even at the free tier, and the trial portal also routes managed service providers through PORT1 (s13). The homepage shows counters of 1K+ devices and 1K+ MCPs curated, the founders' Hacker News post reports 1,000-plus devices across 10 organizations with about 15 AI apps per device (s27), and their Y Combinator launch page reports 1,500-plus devices across five midsize enterprises plus proof-of-concept work with large enterprises (s28). No named customer corroborates any of those figures.

Distribution is the thinnest layer of the strategy. Buyers encounter Traceforce through its own site, its founders, a conference partner listing, sponsored content, and the MCP X-Ray repository, and the reviewed record shows no exclusive arrangement behind any of them. The homepage now names a preferred MDM partner network of Jamf, JumpCloud, NinjaOne, and Iru, a deployment integration rather than a resale motion, and while the contact page now routes MSPs and MSSPs to PORT1 to get started (s2), no cloud marketplace listing appears in fetched sources, so an incumbent shipping equivalent discovery would face little channel disadvantage.

Open source is the distribution experiment carrying the most upside. X-Ray scans connector configurations for free and can upload results to the hosted Atlas service, a tool-to-platform funnel that could seed the registry while creating awareness, and the repository was still taking commits in late July 2026. A July 2026 tutorial on a non-vendor site walked through its commands with no Traceforce sponsorship disclosure on the page (s31), the one write-up in the reviewed record that Traceforce is not shown to have arranged, while the fetched pages document no third-party contributions, so the funnel is a bet rather than an asset.

Public pricing spans three tiers as of July 2026. The free trial covers 10 devices for 30 days with no credit card, the Pro tier is sold per device, and the Enterprise tier, which adds SSO, multi-tenant support, and onboarding services, is custom-priced through sales contact. The rendered Pro card names no figure; the page's structured data carries the numbers, listing $12/month billed yearly or $15/month billed monthly per device (s25), so a buyer reading the page alone leaves without a price.

The published unit is the device, and it is the right unit for this buyer. Security teams count endpoints, so a per-device price makes the spend scale with the fleet a buyer already inventories. The custom Enterprise tier leaves room for site licensing above the metered plan.

Traceforce faces a unit-economics question that public materials do not answer. The monitored surface grows with agents, MCP servers, and skills per device rather than with device count, so device-based pricing absorbs that growth without new revenue, while LLM-driven features such as X-Ray's generated test plans imply model usage whose cost bearer the record does not identify. How Traceforce handles cost spikes, expansion revenue, and agent-driven consumption is not disclosed.

Deployment is MDM-first and documented per platform. The macOS installer ships as a signed and notarized Apple package with two mobileconfig profiles, one granting full disk access and one installing the Chrome and Edge extension, plus Jamf and general MDM post-install scripts. The Windows installer ships as a signed MSI, also packaged for Microsoft Intune, with credentials stored in the SYSTEM Credential Manager, and the quickstart's post-login path starts with creating an API client and downloading the installer, with MDM installation and verification documented separately. The components themselves are non-persistent binaries and a browser extension, per the prerequisites page.

The storage architecture is the most distinctive operational choice. Traceforce stores no scan data on its own infrastructure, and customers connect their own cloud storage, such as Amazon S3, to persist findings and audit logs, which leaves sensitive AI-usage data in the customer's own account rather than the vendor's. Production tenants run at traceforce.co and trial tenants at trial.traceforce.co.

Operational maturity signals are mixed. The documentation index lists versioned release-note pages running through release 1.0.33 (s4, July 2026), a documented API reference, and an llms.txt index formatted for AI assistants, and the quickstart now documents macOS Sequoia and Tahoe, Windows 10 and 11, and the Chrome and Edge browsers as of July 2026. The reviewed documentation covers no Linux endpoint, lists a macOS popup asking permission to find devices on local networks, and states no SLA, status page, or uptime commitment, so a team running Traceforce across a fleet has no published availability commitment to hold it to.

Traceforce publishes a formal trust package. It serves the same two badge assets on its homepage, under a Compliance and Certifications heading (s24), and on its legal page under a Legal and Compliance header, where they render as ISO 27001 and AICPA SOC 2 Type 2 (s34), the standard report type an enterprise buyer asks for. The legal page also publishes a vulnerability disclosure policy, free-trial terms, a data processing addendum, a privacy policy, and a mutual NDA, so the procurement starter kit is present.

What the badges assert is not yet checkable. The rendered legal page carries the pair with no auditor name, no scope statement, and no reporting period (s34), and the trust center at traceforce.trust.cyberbase.ai puts its View audit documents control behind a sign-in (s26), so the scope and period of either attestation are not readable from the public pages. The report type is legible in the badge artwork but not in the markup, since the underlying image files are named ISO 27001 and SOC2 Type 3 with empty alt text on both, so a reviewer reading markup rather than pixels gets a label that matches no report type.

Part of the trust argument is architectural. A vendor whose sensor holds full disk access asks for substantial trust, and Traceforce answers by keeping scan data in the customer's own storage and shipping signed and notarized binaries. Those two choices reduce what a customer must take on faith. The trial additionally requires a Google or Microsoft Workspace email, which qualifies signups as organizational buyers rather than individuals.

The remaining trust question is the counterparty. Traceforce asks enterprises to grant deep endpoint access while the fetched record names no customer and identifies accelerator backing but no priced round, which is exactly the profile a vendor-viability review is designed to catch.

Traceforce shows platform instincts ahead of its platform reality. Traceforce announced a TraceGraph Agent SDK for customers to build their own agents on its platform (s20), the docs expose a documented API reference, an llms.txt file makes the documentation legible to AI assistants, and a Terraform provider supports infrastructure-as-code deployment. Those are the architectural moves of a company designing early for programmatic and agent-driven consumption.

Atlas could become a two-sided dynamic. X-Ray users can upload scan results to Atlas for centralized tracking (s11) and Scout deployments consume its ratings, though no cited page says uploaded results enter the shared registry or improve its ratings. The GitHub README counts over 600 MCPs in the registry, and the fetched pages document no third-party contribution to it.

No third party appears in the reviewed record building on Traceforce. The MDM partner network and the PORT1 MSP route are deployment and onboarding channels (s23, s2), while no marketplace listing, SDK developer ecosystem, or third party building on the SDK appears in fetched sources, and the integration points Traceforce names for the platform are MDM, single sign-on, and customer-owned storage. The SARIF output of the open-source scanner is the clearest advertised path into other security tooling (s11), and no fetched page shows platform findings flowing into a SIEM or a ticketing system.

The founders come from data protection and cloud infrastructure rather than endpoint security, and nothing in the reviewed record shows either of them having shipped an endpoint agent before the one they now ask enterprises to install. CEO Xia Hua was director of engineering at Clumio and built in-memory databases at Oracle, with an MIT education she references in passing on the July 2025 podcast. The Y Combinator launch page describes the pair as the engineers who ran Clumio's engineering organization, Xia as director of engineering and her co-founder as tech lead (s29), and Commvault announced its acquisition of that company in September 2024.

Who the second founder is remains unsettled in the public record. The July 2025 podcast listing names Glenn Mulvaney, the July 2026 launch post introduces the pair as Xia and Varun (s27), and the About page lists Xia Hua and Daniel Seixas, each carrying the title co-founder and CEO (s30). Three names across three public surfaces, a founder interview, a founder-authored launch post, and the company's About page, give a diligence reviewer nothing stable to verify about who is accountable for a sensor holding full disk access.

Execution speed is the team's strongest public evidence. From a February 2025 start, Traceforce shipped a working sensor, a documentation portal with release notes running from 1.0.5 through 1.0.33, displayed ISO 27001 and SOC 2 Type 2 badges, an open-source scanner still taking commits in late July 2026, and a free trial. The fetched GitHub pages document repository activity but no contributor roster, so the engineering bench behind the founders is not measurable from the record.

The organization beyond the founders is mostly invisible. No executive hires, sales leaders, or headcount figures appear in fetched sources, and the founders describe leaning on advisors with prior exits. The reviewed record leaves the sensor's upkeep unattributed beyond the founders.