Solutions · Attack surface discovery Find every agent,
MCP server and API before attackers do.
Agents reach your business through MCP servers and APIs, and teams launch them faster than any inventory updates. Salt finds what is exposed from the outside, what exists in your clouds and code, and what is actually in use, so nothing an attacker can reach stays unknown.
“We had no idea so many of our APIs were externally visible. With Salt, we identified the risk in minutes.”
CISO · Global bank
The challenge
You cannot protect what you cannot see.
Shadow APIs, forgotten MCP servers and agents nobody registered are the easiest way in. Most of them never show up in a gateway or a spec.
01 Exposure grows faster than inventories
Every team, cloud and AI project adds endpoints and tools. Spreadsheets and specs describe last quarter.
02 Agentic entry points nobody mapped
Internet-facing MCP servers and agents can reach real systems and data, often with weak or missing authentication.
03 Tools that count hosts, not APIs
Attack surface tools see IPs and DNS records. They cannot tell which are APIs, MCP servers or agents, or what they do.
The shift
Stop counting hosts. See what an attacker, or an agent, can actually reach.
How Salt solves it
From the outside in, then the inside out.
Step 01 · Salt Surface See what is exposed
Start with your domains. Salt reconstructs your external exposure the way an adversary would, with nothing to deploy.
- APIs reachable from the internet
- MCP servers and their auth posture
- Agentic entry points and shadow assets
Step 02 · Salt Connect Inventory what exists
Read-only connectors find APIs, MCP servers and agents across AWS, Azure, GCP and GitHub, including assets that never generate traffic.
- Cloud gateways and services
- MCP servers in code
- Zombie and deprecated APIs
Step 03 · Salt Collect Confirm what is in use
Runtime traffic shows which assets are live, who calls them and what data they touch, so you fix real exposure first.
- Live calls, users and agents
- Sensitive data in motion
- Spec vs. reality gaps
The modules behind it
Built on the Agentic Security Platform.
Salt gives you breadth across every agent, MCP server and API, and depth across exposure, source code, configuration and runtime behavior. This solution brings together Salt Surface, Salt Connect and Salt Collect.
By role
What it means for your team.
For AppSec and DevSecOps Build securely, find what was missed
- Route shadow APIs and unowned MCP servers to an owner
- Catch undocumented endpoints before release
- Compare live APIs against OpenAPI specs
For SOC Detect and stop abuse with context
- See which exposed assets attackers are probing
- Prioritize alerts on internet-facing, unauthenticated assets
- Send exposure findings to the SIEM
For GRC and compliance Prove control, stay audit-ready
- Show auditors an evidence-based view of external exposure
- Track exposure reduction over time
- Map an acquisition before the deal closes
Go deeper · Feature brief
Reduce your agentic attack surface
A short read for the team evaluating this problem.
Get the feature brief
FAQ
Frequently asked questions about attack surface discovery.
Find what you did not know you exposed.
See your agentic attack surface through an attacker’s eyes. Nothing to deploy.