AI extension security
Keep the good AI tools. Lose the rest.
Developers install skills, plugins and MCP servers into Claude Code, Cursor, Codex and dozens of other AI agents. orta finds every one on every machine and tells you which ones you can trust.
See everything installed
Skills, plugins, MCP servers, hooks, subagents, commands and desktop extensions, per user, per project and managed by IT.
Every agent your team uses
Claude Code, Claude Desktop, Codex, Cursor, VS Code, Copilot CLI, Gemini CLI, Windsurf, Kiro, Zed, JetBrains AI and 21 more.
Catches what hides
Hidden instructions, look-alike names, credential theft, data exfiltration and download-and-run tricks.
A clear verdict for each tool
Each finding is confirmed before it reaches you, and every tool ends up clean, capable or compromised.
Safe to scan
Nothing is executed and no file contents leave the scanner. Checking a tool never runs it.
Your rules, fleet-wide
Allow or deny by name, version or capability. A matching install anywhere raises an alert.
Works with the agents your team already uses.
- Claude Code
- Claude
- Codex
- Cursor
- GitHub Copilot
- Gemini CLI
- Windsurf
- Kiro
- Junie
- Cline
- Roo Code
- Goose
- Qwen Code
- Kimi
- Amp
- Trae
- Mistral Vibe
- OpenHands
- Antigravity
- +13 more
A verdict for every tool.
Clean, capable or compromised. Your team keeps working with the tools that pass, and you hear about the ones that don't.
Why it is called Assay
Refiners assay ore to separate metal from rock. We assay what your AI agents run.
An assay is how a refiner finds out what ore is really worth: how much metal, how much worthless rock, and whether something toxic is mixed in.
AI tooling is ore right now. Thousands of skills, plugins and MCP servers, most of them useful, some careless, a few built to steal. Assay works through all of it, so your team keeps the good tools and loses the rest.