Leoring
Talk to us

Automated guardrails for AI agents

Every skill your AI needs, the moment it needs it, checked before it runs.

The skills your AI needs, under the rules your company sets.

Talk to us See how it works

Finds. Checks. Enforces.

Each dot is one of the 247 public skills in our catalog. The red ones are the 17 we refuse.

01 The shift

AI now learns new skills on the job. A million of them, in seven months.

Months to reach one million
  • npm packages117
  • App Store apps63
  • GitHub repositories27
  • Agent skills7

Vercel, State of agent skills, 25 September 2026 (skills.sh). The comparisons are Vercel’s.

One open standard: Claude, ChatGPT, Gemini and Copilot read the same skill format.

No team can keep up with that many skills. Today’s best quality signal is the install count, and popularity is not safety.

Every new skill is a stranger’s code, holding your agent’s keys.

  • Aug 2025NxThe malware turned its victims’ own AI coding assistants into secret hunters.
  • Sep 2025postmark-mcpFifteen clean versions earned trust. Version 1.0.16 quietly copied every email.
  • Feb 2026ClawHub341 malicious skills found on a single marketplace.

Wiz Research, Aug 2025. Koi Security and Postmark, Sep 2025. The Hacker News, Feb 2026.

Today’s choice: block every skill and fall behind, or allow every skill and be the next incident.

02 The product

Imagine an antivirus for AI that makes it more capable.

Guardrails don’t hold AI back. They let it go further. Not a filter on what AI says. Guardrails on what AI does.

  1. Check.

    skill.trust

    The aggregated catalog. Semantic search by intent, with every skill checked on 12 categories of evidence and pinned to the exact code.

    Our catalog

  2. Enforce.

    Magentic

    The last skill your AI will ever need to install. Magentic is itself a skill, in the open format every major AI reads. Load it once. It finds the best skill for each task, the moment your AI needs it, and holds it to your rules before it runs.

    Inside your AI

  3. Govern.

    Organization console

    Your rules, written once, on every agent, every time. Every decision recorded, so you can see what was allowed, held or refused, and why.

    Where the rules live

03 How it works

From a task to a recorded decision.

  1. TaskYour AI starts work.
  2. Capability gapIt needs something it does not have.
  3. Search by intentMagentic asks the catalog, in plain words.
  4. Candidate and evidenceThe best match arrives with what its code can reach.
  5. Policy and version checksYour organization’s rules and the pinned version are checked.
  6. Decision Install Load Hold Refuse
  7. Agent continuesWork goes on with the skill it was allowed.
  8. Recorded decisionEvery outcome is written to the record.

The moment that matters

I said yes. The policy said no.

magentic: found hipaa (trust 82.2), not installed, waiting for your approval
User answered: Yes
REFUSED by divergence policy: the claim does not disclose credential_read, which the code reaches.

A score is not enough. A person’s yes is not enough. The evidence decides.

Verbatim lines from a session log, production, 9 October 2026. A real public listing, refused by the gate. A refusal is a policy decision, not a finding that a skill is malware.

04 Evidence

More than 1 in 5 is held for review or refused before an agent may run it.

approved
193an agent may install it
held
37a person must look first
refused
17it does not run
public listings
247as of 9 October 2026

Held does not mean malicious. These are catalog outcomes, not customer counts.

05 One skill, any AI

One open standard read by Claude, ChatGPT, Gemini and Copilot.

  • ClaudeMeasured end to end. Live in Claude Code, loaded from Magentic’s skill file alone.
  • ChatGPTReads the same skill format. End-to-end runs are next.
  • GeminiReads the same skill format. End-to-end runs are next.
  • CopilotReads the same skill format. End-to-end runs are next.

measured next

06 Pricing

Free to discover. Paid to govern.

  • Free

    Discovery and just-in-time skill retrieval for individual developers.

  • Team

    Organization policy, console, audit record.

  • Enterprise

    Contracts, attestations, HIPAA BAA.

Team and Enterprise are in early access. The way in is a conversation.

Talk to us