Search The Catalog
MCP Inspector
Market Space
Safe-Use Guides
Ready-to-use RFP
Option 1
The AI enablement standard
The must-have requirements, ready to send today
The AI enablement standard RFP
Is your vendor agentic-endpoint ready? Shadow AI, Prompt injection, Rogue agents, Agentic supply chain attacks. One free standard, measurable pass criteria for each
Two ways to use it
Option 2
Customize it to your needs
Start from the baseline, then add optional requirements or remove what doesn't apply.
The AI enablement standardCustomize the AI enablement standard
16/33 Selected requirements
What it covers
The core requirements for today’s AI threats, across 6 domains
Discover
Shadow AI, unsanctioned tools and exposed MCP servers
Assess
How risky an agent, MCP server or skill is
Map
What runs, what it can reach, and the blast radius if exploited
Runtime Protection
Catch AI-powered risks inside live sessions
Control
Over-privileged agents and risky calls are blocked before they act
Operate
How it deploys, who gets access, and how it plugs into your stack
Requirements
Each requirement comes with pass criteria the vendor must meet live, in the proof of concept.
Discover
Shadow AI, unsanctioned tools and exposed MCP servers.
AI tools
Find every AI tool in use: on employee desktops, in browsers, and in cloud AI platforms. Cover AI assistants, coding agents and app builders, notetakers, and browsers with built-in AI. For each, show how it was found, how widely it is used, and who uses it.
How to verify
The vendor lists the AI tools found on our own devices and in our own cloud AI platforms during the proof of concept, across all the listed categories, and shows for each how it was found, how widely it is used, and who uses it.
AI supply-chain
List every MCP server, skill, plugin and extension that AI tools use, and every package that AI agents install. For each, show where it came from, how it was found, and who uses it.
How to verify
The vendor lists what it finds on our own devices during the proof of concept, each item with its source, how it was found, and its users.
AI-built apps and agents
Find the apps and agents employees built with AI tools. For each, show the builder, what it connects to, its owner and its last activity.
How to verify
The vendor lists the apps and agents found in our connected builder platforms, each with its builder, connections, owner and last activity.
Shadow AI detection
Detect new and unapproved AI tools, AI supply-chain items, AI-built apps and agents, and models as they appear, without a pre-set list of what to look for. Show each item’s context to investigate it: where it came from, who owns it, and who uses it.
How to verify
The vendor shows how quickly a newly installed item appears on one of our devices, flagged as new or unapproved, with its origin, owner and users, across all four types: AI Tools, supply chain, apps and agents, and models.
Local and open-weight models
Detect locally installed AI models, including open-weight models. For each, show how it runs, who uses it, and when it was last seen or used.
How to verify
The vendor finds a locally installed model on our devices and shows how it runs, who uses it, and when it was last used.
Assess
How risky an agent, MCP server or skill is.
Risk rating
Use one consistent risk rating system across all component types (tools, supply chain etc.), explain the logic behind each rating, and map it to known security frameworks such as OWASP.
How to verify
The vendor rates the components found on our devices and platforms across all four types, shows the evidence and logic behind one rating, and shows how it maps to a security framework.
Prioritized issues
Automatically open issues for risks that requires timely attention. For each issue, show the finding behind it, the affected item and its owner, a severity that follows the finding, and what to do next.
How to verify
The vendor shows the issues raised on our own devices and platforms during the proof of concept, each with its finding, affected item, owner, severity and next step.
Framework mapping
Map each risk to a recognized security framework, such as OWASP or NIST AI RMF. State which frameworks you cover.
How to verify
The vendor shows one rated component with each of its risks mapped to a framework, and lists the frameworks it covers.
Malware and vulnerability scanning
Scan AI components continuously for known vulnerabilities and malicious code.
How to verify
The vendor flags malicious or critically vulnerable component as an issue.
Publisher provenance
Trace AI tools, supply-chain items and models to its publisher. Show who published it, how credible the publisher is, and whether it is an official source.
How to verify
The vendor shows publisher, credibility and official-source status for one tool, one supply-chain item and one model on our devices.
Map
What runs, what it can reach, and the blast radius if exploited.
Map blast radius
For any AI tool or supply-chain component, including one installed but never run, show the users, devices and agents that have it.
How to verify
The vendor picks an MCP server and an AI tool on our devices, including one installed but never run, and shows the users, devices and agents that have it.
Agent identity and owner
For each agent, show the identity it runs as and its named owner.
How to verify
The vendor shows both for two agents on our devices.
Agent reach map
For each agent, show the systems and data it can reach.
How to verify
The vendor shows the systems and data that two agents on our devices can reach.
Agent flow map
Show how each agent operates as a flow: trigger, model, systems read and written, where output is delivered, and which actions run unattended.
How to verify
The vendor shows all of these for two agents on our devices.
Runtime Protection
Catch AI-powered risks inside live sessions.
Session record
Record each agent session: the actions taken, the tools called and the results. Assosiate session with builder, agent and use-case(s).
How to verify
The vendor replays one session from the proof of concept, step by step.
Prompt injection defense
Detect prompt injection in content an agent reads (web pages, documents, tool results).
How to verify
The vendor runs our own runtime sessions and shows what is detected and what happens next.
Bulk data exfiltration
Detect an agent moving data out in bulk, such as copying many repositories or exporting thousands of records to an outside destination.
How to verify
The vendor runs our own runtime sessions and shows what is detected and what happens next.
Sensitive data in prompts
Detect personal data, customer data and secrets in prompts, uploads and configuration files, including in browser-based AI tools.
How to verify
The vendor detects personal data, customer data and a secret that we send in a prompt or an upload.
Misaligned behavior
Flag agent actions that are unusual for that agent or do not fit its task, such as reaching for credentials the task never needed.
How to verify
The vendor shows a flagged action from a session and the reason it was flagged.
Control
Over-privileged agents and risky calls are blocked before they act.
Action blocking
Block an action before it completes, for example a file upload, a tool call or an install. State which actions can be blocked.
How to verify
The vendor blocks a test action on our device, shows that it did not complete, and lists which actions it can block.
Monitor-only mode
Run any policy in monitor-only mode first, scoped to existing user groups. State which policy wins when scopes overlap.
How to verify
The vendor sets a policy to monitor-only for one of our groups, shows what it would have blocked, and shows which policy wins when two of our groups overlap.
Employee notice
Tell the employee when an action is blocked or flagged, and why. State whether the message can be customized.
How to verify
The vendor shows the message an employee sees for a blocked action and for a flagged one, with the reason, and how the message is customized.
Approved route to AI
Point employees to an approved tool when they use an unapproved one.
How to verify
The vendor shows an employee on an unapproved tool being sent to an approved one.
Actions beyond blocking
Offer responses other than blocking: stop an agent, remove a component, redirect a personal account, or ask the user to confirm. List which ones you support.
How to verify
The vendor demonstrates two of these responses during the proof of concept and lists the others it supports.
Personal account control
Block personal-account use while enterprise accounts keep working.
How to verify
Demonstrate personal account being blocked while the enterprise one works.
Policy log
Log every time a policy acts, whether it blocks or only matches in monitor mode. For each entry, record which policy applied and the outcome.
How to verify
For a blocked action from last week and a monitor-mode match that the evaluator picks, the vendor retrieves the full record. It shows when the policy acted, for whom, on which device, what was attempted, which policy applied and the outcome.
Operate
How it deploys, who gets access, and how it plugs into your stack.
Rollout
Deploy through existing device management on every operating system in scope.
How to verify
A zero-touch install through our device management on each operating system in scope.
Privacy
Let the customer choose whether prompt and session content is collected for risk analysis, offer retention options for that content. Mask secrets and personal data.
How to verify
The vendor shows the setting that turns collection on or off and what changes when it is switched. It shows the retention options and a secret and a personal detail masked in stored content.
SSO and provisioning
Sign in through the organization's identity provider, with users and groups provisioned and removed automatically from it.
How to verify
The vendor signs in through our identity provider. A user and group created there appear automatically, and removing the user removes their access.
Audit trail
Record changes made in the platform, such as policy or issue status changes, with who made them, when, and what changed.
How to verify
The evaluator changes a policy and an issue's status. The vendor shows both entries with who, when, and what changed.
Role-based access control
Control access with roles for administering, managing policy and read-only viewing. Let a role be denied prompt content, and assign roles from identity provider groups.
How to verify
The vendor lists its roles. It shows a read-only user who cannot change anything, a role that withholds prompt content, and a role assigned from an identity provider group.
Data access: API, MCP and export
Give the organization access to its own data through an API, an MCP server and export: inventory, findings and audit records.
How to verify
The vendor retrieves inventory, findings and audit records through the API, queries them from an AI agent through the MCP server, and exports them.
Security workflow integrations
Send findings to the ticketing, case, SIEM and chat systems the team already uses. Open tickets or cases from findings, automatically or on demand.
How to verify
The vendor opens a ticket or case from a finding in our system, automatically and on demand, and delivers findings to our SIEM and chat tool.
Bring your RFP. We’ll bring the demo.
Watch Pluto work through it live, from finding what’s running to stopping what shouldn’t be.
