Traceforce, a Y Combinator S26 startup founded by Xia and Varun, provides enterprise security monitoring for AI applications. The company states that its tool discovers and visualizes which AI apps, such as ChatGPT and Claude, are being used on which devices and which data sources they are connected to via MCP.
Product LaunchesSecurityTraceforce
Traceforce Releases Security Tool to Monitor AI Apps and MCP Connections Across Enterprises
This article is a translation. Read the Japanese original
Deployment is handled by installing a lightweight binary and a browser extension on each device, with live data reflecting on the corporate dashboard within 30 minutes. Security officers can reportedly monitor all agent activity in real time, apply controls, and receive alerts when security risks occur.
Regarding privacy, the tool collects only metadata and telemetry for AI apps, MCPs, and tools by default, while all content inspection is executed locally on the device. The company states that user prompts are not stored unless explicitly configured by the organization's security administrator.
The tool is currently deployed across 10 organizations and more than 1,000 devices. Traceforce reports discovering an average of over 15 AI apps per device, with each app connected to 5 to 10 MCPs. The company also stated that the tool has helped prevent the exposure of plaintext secrets within MCP settings and the leakage of API keys.
Additionally, the company provides "mcp-xray" (https://github.com/traceforce/mcp-xray), an open-source MCP penetration testing tool that can be used to detect vulnerable MCPs.
Source: Launch HN: Traceforce (YC S26) – Company-wide security monitoring for AI apps（HN 44pt・28コメント） (HN Search (backfill), 2026-07-17)