CI + fleet audit for MCP agents

Inventory and policy for agents in CI

OrcaTrac sits on the MCP tool path — records calls, syncs org policy, and fail-closes in CI. Start with visibility; tighten BLOCK / ASK when you are ready. We do not claim to block every model hallucination.

Start free — under 15 minutes Signup → key → CI path

Already have an account? Sign in →

OrcaTrac — CI / fleet audit

live

TOOLRUNNERRISKDECISION

execute_sql DROPci-runnerHIGHBLOCK

list_filesci-runnerLOWALLOW

bash curl egressclaude-codeHIGHBLOCK

read_configci-runnerLOWALLOW

write_fileclaude-codeMEDIUMWARN

Works with MCP hosts you already use

GitHub Actions and other CI runners, Claude Code hooks, Claude Desktop stdio proxy, and Cursor MCP configs. Listing a model family here is not a coverage claim — enforcement depends on the host path (CI profile, hooks, or proxy) and your org policy.

The problem

Agents in CI have tools — and no shared audit console.

Local stdio MCP has no admin plane. Prompt injection and over-permissioned tools are real risks; the first purchasable control is inventory plus policy you can enforce in non-interactive runners.

execute_sql

HIGHDestructive SQL in a pipeline

bash + egress

HIGHPrivate data leaves the runner

deleteFile

HIGHRepo blast radius, no log

How it works

Protected CI run in three steps

Designed for platform engineers — signup to first audited runner in under 15 minutes.

Sign up & create a key

Free org in minutes. Create an API key under Settings → API Keys.

$ https://orcatrac.com/auth/signup

Protect a CI job

Store ORCATRAC_API_KEY, set ORCATRAC_PROFILE=ci, wrap your MCP server.

$ orcatrac run -- <your-mcp-server>

Review the audit trail

Events land in the dashboard. Tighten policy once you see the inventory.

$ open https://orcatrac.com/dashboard

Full quick start with workflow snippet →

What ships today

Honest capabilities — not magic

CI inventory & audit first

See every MCP tool call from headless runners in one org dashboard — who called what, risk class, and decision — before you tighten enforcement.

Fail-closed CI profile

ORCATRAC_PROFILE=ci defaults to block and fails closed if the control plane is unreachable. Dashboard policy still wins once synced.

Arg- and session-aware risk

Beyond name prefixes: MCP annotations, SQL verb class, shell egress patterns, custom exact/glob rules, and session lethal-trifecta state.

Ride host hooks

Claude Code PreToolUse / PostToolUse hooks apply org policy and optional ASK webhooks. We do not replace Anthropic permissions — we add fleet policy + audit.

Redaction & retention modes

CLI redacts secrets before upload. Orgs choose full, metadata-only (default), or zero-retention so audit does not mean dumping raw args to the cloud.

Shared org policy

One control plane for CI runners, Claude Code hooks, and stdio proxy hosts. Custom ALLOW / WARN / BLOCK / ASK rules without redeploying agents.

Risk classification

Heuristic + annotations + args

Defaults help day one; org custom rules and CI block mode are how you harden.

SignalExamplesTypical action

HIGHdestructiveHint · DROP/DELETE · bash egressBLOCK in CI profile

MEDIUMwrites · updates · session trifecta build-upWARN or ASK on hosts

LOWreadOnlyHint · list_* · get_* · query_*ALLOW + log

Result inspection and large attack-corpus evals are still Phase 4 follow-ons — we do not market those as shipped.

Ready for a protected CI run?

Create an account, mint a key, paste the workflow. Optional waitlist if you only want launch updates.

Create free account View pricing