Find the path before an attacker does.
ExfilPath checks your AI agent for the one flaw that matters most: whether attacker-controlled input can reach an action that causes damage.
Add your agent's source code. ExfilPath reads it without ever running it and finds three things — where untrusted input gets in, which actions can leak data or change systems, and whether anything stands between them. When nothing stands between them, that's a path.
Built by a Nepal-based team with years of experience building ai systems for companies in nepal and beyond.
- 46
- detectors
- 3
- languages
- Seconds
- to a full report
- sourcesrc/inbox.ts:9Inbound email body
const response = await graphClient.api('/me/messages').top(1).get();
- carriedsrc/triage-agent.ts:15Folded into the prompt
const prompt = [`Subject: ${mail.subject}`, `Body: ${mail.body}`].join("\n");
- modelsrc/triage-agent.ts:23Trust boundary crossed
const completion = await openai.chat.completions.create({ ... });
- carriedsrc/triage-agent.ts:30Passed into sendSummary()
await sendSummary(answer);
- sinksrc/notify.ts:5Outbound HTTP request
await fetch(link, { method: "POST", body: JSON.stringify({ text: summary }) });
Nothing stands between them. No allowlist, no schema, no approval on the value.
Smallest change that closes it: resolve the destination host against a fixed allowlist before the request leaves.
Reviewed with security and platform teams in Nepal and beyond
The gap
Existing tools scan components and hand you a list of warnings.
Scanners grade components
A dependency check, a secrets scan and a prompt-injection classifier each look at one part in isolation. All three can pass while the parts still line up into a route.
Breaches use the route
EchoLeak and ForcedLeak both worked with every component configured correctly. The flaw was that untrusted text could reach an action that sends data outward.
A list cannot show a route
Warnings tell you a network call exists. They do not tell you that an email body can choose its destination. That difference is the entire finding.
How it works
Three questions, asked of your actual code.
Where untrusted input gets in
ExfilPath maps the surfaces an attacker can write to: inbound mail, retrieved documents, scraped pages, tool and MCP results, CRM and ticket fields, uploads, queues and end-user messages.
17 input surfaces across 10 categories
Which actions cause damage
Then it maps the actions that leak data or change systems: outbound requests, auto-fetched media in rendered output, mail and chat sends, code execution, data and file writes, cloud calls, payments and tool dispatch.
15 sensitive actions across 8 categories
Whether anything stands between them
Last, it looks for controls on the value itself: schema validation, destination allowlists, egress policy, authorisation, sandboxing and human approval. When nothing covers the value, that is a path.
9 control types, 5 model boundaries
CRITICAL Inbound email reaches network egress 82% confidence
source src/inbox.ts:9 Microsoft Graph mail item
carried src/triage-agent.ts:15 folded into the prompt
model src/triage-agent.ts:23 trust boundary crossed
carried src/triage-agent.ts:30 passed into sendSummary()
action src/notify.ts:5 outbound HTTP request
Nothing covers the value on the way.
LLM02:2025 Sensitive Information Disclosure · CWE-918const ALLOWED_HOSTS = new Set(['hooks.internal.example.com']);
function safeFetch(rawUrl: string, init?: RequestInit) {
const url = new URL(rawUrl);
if (!ALLOWED_HOSTS.has(url.hostname)) {
throw new Error(`egress blocked: ${url.hostname}`);
}
return fetch(url, init);
}
// re-analyse: 0 open paths, 1 closed by a controlCapabilities
Built to make one finding trustworthy.
Cross-file path tracing
Routes are followed through assignments, template strings, helper functions and across files, so a finding shows the whole path rather than one suspicious line.
The model is part of the path
Text that enters a prompt comes back out as instructions. ExfilPath keeps tracking the value through the model call and raises severity when it crosses that boundary.
Existing controls are credited
A route with an allowlist, a schema parse or an approval gate in the middle is reported as closed. You see it without being asked to act on it again.
The smallest closing change
Every open path ships with a concrete fix scoped to the action — usually a few lines — instead of generic advice to sanitise input.
Your agent is never executed
Analysis is entirely static: no sandbox runs, no live prompts, no credentials, no calls to a model provider.
Release gate, not a report
Thresholds turn a path into a build decision, so a new route fails the pipeline in the pull request that introduced it.
Framework-aware
Coverage spans LangChain, LlamaIndex, the Vercel AI SDK, MCP servers, OpenAI, Anthropic, Gemini, Bedrock, Microsoft Graph, Gmail, Salesforce, Playwright, vector stores and common web frameworks.
Explainable severity
Severity follows the impact of the action, the trust level of the input and whether the model boundary is crossed — and every score shows its reasoning.
Evidence you can hand over
Structured JSON for tooling and a written report for reviews, audits and customer security questionnaires.
What you get
A report an engineer can act on and a reviewer can sign off.
The route, step by step
Every hop from input surface to action, with file and line, the code at each step, and the model boundary marked where it is crossed.
Severity with its reasoning
Impact of the action, trust level of the input, and whether the value passes through a model — each contribution shown, not just a number.
Controls found on the way
What already stands between input and action, whether it fully closes the route, and why a partial control is not enough.
The smallest closing change
A concrete patch at the point of the action, sized in lines rather than sprints, with the language matched to the file.
Standards mapping
OWASP LLM Top 10 category and CWE identifier on every finding, so it lands in the workflow your organisation already runs.
Exportable evidence
Structured JSON for pipelines and dashboards, and a written report for reviews, audits and customer questionnaires.
Who uses it
Different teams, the same question.
AI platform teams
Ship agents without a security review bottleneck
Teams building internal agent platforms need a repeatable answer to “can this agent leak our data?”. ExfilPath turns that into a check that runs on every change, so review time goes to design decisions instead of reading code for routes.
- A path report attached to every pull request
- Thresholds that block a merge introducing a new critical route
- A shared vocabulary — input surface, action, control — across teams
Application security teams
Assess an agent you did not write
Security teams inherit agent code from many teams and vendors. ExfilPath produces the map in minutes: what the agent reads, what it can do, and where those two meet without a control.
- Coverage across repositories without reading every file
- Findings mapped to OWASP LLM Top 10 and CWE for existing workflows
- Evidence for risk acceptance decisions, with the trace attached
Product engineering
Design the guard before the incident
Most exposure is created in an afternoon of wiring a tool to a model. Running an analysis while the design is still fresh shows exactly which action needs an allowlist, a schema or an approval step.
- Concrete fixes at the point of the action, not vague hardening advice
- Confirmation that a control actually covers the value it is meant to
- A record of which routes were closed and how
Where it fits
From the first prototype to the release record.
Decide where the controls go
Analyse the prototype before it becomes the architecture. The report shows which action needs an allowlist, a schema or an approval gate.
Check the change, not the whole repo
Analyse the files you touched and see the route your change created before it reaches review.
Turn a path into a build decision
Thresholds fail the pipeline when an open path at or above your chosen severity appears, so a route is caught in the pull request that introduced it.
Keep the evidence
Each release carries a report: open paths, closed paths, and the controls that closed them — the record auditors and customers ask for.
Where it fits in your stack
It is not another scanner. It is the layer none of them cover.
| Capability | ExfilPath | SAST / code scanners | Prompt-injection guardrails | Runtime AI firewalls |
|---|---|---|---|---|
| Shows the route from untrusted input to a damaging action | Yes | No — findings are per-rule | No — screens text only | Partly, after the fact |
| Understands AI-specific input surfaces (RAG, MCP, tool results) | Yes | Rarely | Some | Some |
| Treats the model call as a trust boundary | Yes | No | Not applicable | Partly |
| Credits controls you already have | Yes — routes report as closed | Limited | No | No |
| Works before deployment | Yes | Yes | Yes | No — needs live traffic |
| Runs without executing your agent | Yes | Yes | Needs prompts and a model | Needs production traffic |
| Produces a fix rather than an alert | Yes | Sometimes | No | No |
Why routes matter
Two breaches where every component was configured correctly.
EchoLeak
CVE-2025-32711Microsoft 365 Copilot · Disclosed June 11, 2025 · found by Aim Labs (Aim Security)
A single crafted email could make Copilot pull sensitive context and send it to an attacker-controlled server with no user interaction. Aim Labs described it as an LLM scope violation, and it is widely reported as the first zero-click prompt-injection exploit against a production AI system.
The lesson: Every component behaved as configured. The exposure was that an untrusted mail body could reach an output channel the client fetches on its own.
In ExfilPath terms: Inbound mail is an input surface, rendered media in model output is a sensitive action, and neither redaction nor a classifier fully covers the value — so this shape reports as an open critical path.
ForcedLeak
CVSS 9.4 vulnerability chainSalesforce Agentforce · Disclosed September 2025 · found by Noma Labs (Noma Security)
Instructions placed in the Description field of a public Web-to-Lead form were executed when an employee asked Agentforce to process the lead. CRM data was then exfiltrated through an image request to a domain still on the trusted list — a domain the researchers noted could be bought for about five dollars.
The lesson: Public form input reached an action that could both read records and make outbound requests. Salesforce began enforcing Trusted URL allow lists for Agentforce and Einstein generative AI agents on September 8, 2025.
In ExfilPath terms: A CRM free-text field is an input surface, an outbound request is a sensitive action, and a trusted-URL list only closes the route when the code resolves the destination against it.
Coverage
Built for the stacks agents are actually written in.
Languages
- TypeScript
- JavaScript
- Python
- Java (roadmap)
- Go (roadmap)
Agent frameworks
- LangChain
- LangGraph
- LlamaIndex
- Vercel AI SDK
- CrewAI
- Custom orchestration
Model providers
- OpenAI
- Anthropic
- Google Gemini
- Amazon Bedrock
- Local and self-hosted models
Input surfaces
- Inbound email
- RAG and vector stores
- MCP and tool results
- CRM and ticketing
- Scraped web content
- Uploads and queues
Sensitive actions
- Network egress
- Rendered output
- Mail and chat
- Code execution
- Data and file writes
- Cloud control plane
- Payments
Workflow
- Instant analysis
- GitHub Actions
- GitLab CI
- Jenkins and any runner
- JSON and report export
Workflow
Start with full local analysis. Expand into every workflow.
Instant analysis
AvailableFull analysis is live and free during early access. Point ExfilPath at a file, a folder or a full repository and read the complete report in seconds.
JSON and written reports
AvailableDownload structured JSON for tooling or a readable report for reviews, fixes and handoff.
CLI and CI workflows
Coming soonBring the same path engine to the terminal and your pipeline, with thresholded checks and release evidence.
MCP workflows
Coming soonConnect path analysis to the agent tooling and workflows your team already uses.
Full local browser analysis
Select a file, folder or full repository and get a complete path report in seconds. Nothing is uploaded, and your agent is never executed.
Open the analyzer →CLI, CI and MCP workflows
Bring the same detectors, path traces and fix guidance into terminal, pipeline and MCP-connected workflows as those surfaces roll out.
The platform
Specifics, not adjectives.
46
detectors in the analysis engine
17 input surfaces · 15 sensitive actions · 9 control types · 5 model boundaries
3
languages traced end to end
TypeScript, JavaScript and Python, with Java and Go on the roadmap
Static
analysis by design
Your agent is never executed, and no model provider is involved at any point
Seconds
from repository to report
A typical agent service completes in under a second
Early reviews
Engineers who put the platform against their own agents.
“Our scanners were green while an email could still walk a summary straight out to an external host. ExfilPath was the first tool that drew that route instead of handing us another list.”
“The part that changed my mind was the trace through the model call. Everyone talks about prompt injection in the abstract; this showed the exact three lines that made it exploitable.”
“It reads the repository, finds where untrusted text enters, and tells you which action it can reach. We closed two paths with one-line changes the same afternoon.”
“What I want from a security tool is a decision, not a dashboard. Open path or no open path is a decision my team can act on in a release meeting.”
Pricing
Free during early access. Priced for teams after that.
Free while ExfilPath is in early access
Every capability below is unlocked today at no cost, including the paid-plan features. No card is collected anywhere on this site. Billing begins at general availability, and early-access accounts get 30 days notice and a founding discount before anything changes.
Plans at general availability
Published now so you can plan a budget. Nothing is billed during early access.
Developer
Free during early access
For an individual engineer or a single agent in production.
- 1 developer seat
- Up to 5 projects
- Unlimited analyses, in the app and in CI
- Full path traces with the model boundary marked
- Fix guidance on every open path
- JSON and written report export
- OWASP LLM Top 10 and CWE mapping
- Community support
Team
Free during early access
For a team shipping agents on a shared codebase.
- Everything in Developer
- Unlimited projects and repositories
- Shared report history and path timeline
- Pull-request comments on new and closed paths
- Per-repository policy thresholds
- SARIF export and code scanning integration
- Ownership routing for open paths
- Email support, one business day
Business
Free during early access
For organisations running many agents across many teams.
- Everything in Team
- Organisation-wide path dashboard and trends
- SSO with Google, Microsoft and Okta
- Role-based access and audit trail
- Custom input surfaces, actions and controls
- Release evidence export for audits
- Security questionnaire support
- Priority support with a named contact
Enterprise
Free during early access
For regulated environments and code that cannot leave the network.
- Everything in Business
- Self-hosted or air-gapped deployment
- Private detector packs for internal frameworks
- Architecture review with our research team
- Contractual SLAs and security review support
- Volume and multi-year agreements
- Onboarding and enablement sessions
Prices are in USD and exclude local taxes. Annual billing is charged yearly and saves roughly 20%.
How we build
Four rules we hold ourselves to.
One question, answered well
We are not building a dashboard for everything. We answer whether a route exists and how to close it.
Findings must be arguable
A finding you cannot verify is a finding you will ignore. Every path shows its trace, its controls and its reasoning.
Read code, never run it
Analysis stays static, so assessing an agent is never itself a risk.
Security tooling should be easy to adopt
No credentials, no agents to deploy, no data pipeline. Point it at code and get an answer.
FAQ
Questions engineers ask first.
What exactly does ExfilPath check?
How is this different from a code scanner?
Do you run my agent or send prompts to a model?
Where is my source code processed?
Which languages and frameworks are supported?
What does it cost?
How do you handle false positives?
Can it gate a release?
How does this map to frameworks we already report against?
What is on the roadmap?
Who is behind ExfilPath?
How do I report a security issue in ExfilPath itself?
Analyse an agent in the next two minutes.
Add a file or a folder. If there is a route from untrusted input to a damaging action, you will see it step by step, with the smallest change that closes it.
Free during early access · no card required · your source is analysed on your own device.