Salt Collect · Runtime behavior, tagged live See how your APIs, MCP servers and agents actually behave.
APIs change constantly, and most tools rely on snapshots and schemas. Salt Collect analyzes live API and agentic traffic to show who is using what, what they can reach and where sensitive data moves. Start agentless, then add runtime depth where it matters.
“Salt Collect revealed an auth flaw that scanners completely missed. That insight alone paid for the platform.”
DevSecOps Lead · Retail enterprise
The problem
The spec says one thing.
Production does another.
Schemas and snapshots describe what APIs were meant to do. Attackers and agents act on what they actually do.
01 Snapshots go stale
APIs evolve constantly. Specs and scans describe last month, while production has already drifted.
02 Sensitive data moves unseen
Without traffic context, you cannot tell which APIs, agents and MCP servers are handling PII, credentials or payments.
03 Behavior changes go unnoticed
Subtle shifts in who calls what are the early signal of abuse, and they only show up in real usage.
The shift
Stop reading the spec. Read the traffic.
How it works
From live traffic to risk you can act on, in four steps.
Step 01 Collect where traffic flows
Salt Collect ingests API and agentic traffic through collectors placed where traffic already flows. Start with agentless visibility, then add runtime when you are ready.
- Gateways and edge
- Cloud and Kubernetes
- No architecture rewrite
Step 02 Parse and normalize
Deep parsing and normalization across 100+ runtine and infrastructure integrations turn raw traffic into a consisten picture of APIs, MCP calls and agent actions.
- REST, GraphQL and gRPC
- MCP tool calls
- Users, sessions, sequences
Step 03 Baseline and classify
Salt builds behavioral baselines and classifies sensitive data in motion, so it knows what normal looks like for every API and agent.
- Behavioral baselines
- Sensitive data classificaton
- Drift and miscofiguration
Step 04 Surface risk with context
Fingings combine runtime behavior with code and configuration context, so you fix real risk first and feed it back into governance and protection.
- OWASP API Top 10 risks
- Auth flaws scanners miss
- Feeds Protect and the graph
Part of the platform
Exposure is the first layer of depth.
Salt gives you breadth across every agent, MCP server and API, and depth across exposure, source code, configuration and runtime behavior. Surface is where the picture starts.
Capabilities
What you get with Salt Collect.
Runtime analysis
Calls, users and sessions across APIs, MCP servers and agents.
Misconfiguration and drift detection
Catch the gap between what was specified and what runs.
Sensitive data tracing in motion
See where PII and other sensitive data actually flows.
Behavior anomaly insights
Spot changes against a learned baseline as they happen.
Agent and MCP visibility
Follow agent actions across tools down to the API call.
Context-prioritized risk
Rank findings using code, configuration and runtime together.
Use cases
Where your team would use it.
OWASP API Top 10 risk detection
Find the vulnerabilities that only show up in real usage.
Data classification and compliance mapping
Map sensitive data flows to the frameworks you report against.
Audit readiness and posture tracking
Show auditors an evidence-based view of external exposure, and track how it improves over time.
Integrations
Collect from where traffic already flows.
Collectors sit alongside the gateways and edge services you already run. Nothing to replace, nothing to reroute.
See how your APIs behave in production.
Turn live traffic into context your team can act on.