Tideline pre-release

See how far your agents reach.

Tideline maps what every AI agent can touch: the credentials it can read, the tools it can call, and the systems those open. Before an attacker or a bad prompt finds out for you.

Run your first scan $ tideline scan .  local, read-only, no account
Reach map How it works Why now Pricing
highest reach found in the example scanClaude Code on a laptop → production AWS admin, via ~/.aws/credentials

Reach map · try it

Pick an agent. Watch the water rise.

Each row is a layer of your stack, from local files down to production data. The line stops at the deepest layer the agent can reach with what it already holds.

Example scan of a fictional company. Real scans read config files on your machine and list credential kinds and locations, never their values.

claude-code · ~/projects/apireach 88/100
local files
code & CI
SaaS
cloud
production data
potential lethal trifectaFix: move AWS keys to SSO with a read-only role for this repo.

How it works

First, install it locally.

One Python package with no dependencies. It opens no network connection and writes nothing to your system.


    

  






  

    

      
Buyers already pay for this map.
Large security companies have spent billions buying tools that answer "who can access what". Agents are the newest "who".

      
$1.2B
ServiceNow's purchase of Veza, an effective-permissions graph
closed Mar 2026 · market fact

      
$637M
CrowdStrike's purchase of SGNL, real-time authorisation
closed Feb 2026 · market fact

      
13
machine and agent identity security companies acquired since 2023
NHI consolidation tracker · market fact

      
0
network connections opened during a scan, enforced by tests
Tideline · product fact

      
54
automated tests, including regression tests for two independent code audits
Tideline · product fact

      
8
agent hosts detected today: Claude Code, Cursor, Windsurf, VS Code, Claude Desktop, Gemini CLI, Codex CLI, GitHub Actions
Tideline · product fact

    

    
Market facts describe the category, not Tideline's customers. Tideline has no customers yet.

  






  

    

      

        
Pricing

        
Free where you work.

        
The scanner is open source and runs on your machine and in CI at no cost. Paid plans are for teams that need it set up, kept current and turned into evidence.

        

          
Team · US$299/monthDrift gates set up across your repos, a monthly reach report, priority detection requests.

          
Organisation · US$15,000/yearApproval review for every AI use case, evidence packs mapped to your regulators, quarterly re-approval review.

          
Singapore financial institutionsMAS AI risk management readiness assessment, S$1,500. Annual evidence programme from S$15,000.

        

      

      

        
$0/ month, open source

        
        
    
          
  • Local scan of every agent config on the machine
    • 
          
  • Text, JSON, Markdown, Mermaid and SARIF reports
    • 
          
  • CI gate that fails when an agent's reach grows
    • 
          
  • Approval review that flags AI approvals a change has made stale
    • 
          
  • MIT licence
    • 
        

        Get the command
      

    

  






  

    
Questions

    
Before you run it.

    

      
secrets
It reads configuration files to learn that a credential exists, what kind it is and where it lives. Known secret shapes are redacted from every output format, and tests plant synthetic secrets to check this. Redaction is pattern-based, so an unusual format placed in a name or path could slip through; the docs say so.

      
network
No. A scan opens no network connection and writes no files. A test fails the build if that changes. Installing the package from PyPI uses the network, as any install does.

      
agents
Claude Code, Cursor, Windsurf, VS Code MCP, Claude Desktop, Gemini CLI, Codex CLI and GitHub Actions agent workflows. Cloud connectors for AWS, GitHub and Google Workspace permissions are in development.

      
trifecta
An agent that reads untrusted input, can reach private data and has a way to send data out. Tideline flags it as potential, because config files show what is reachable, not what an agent will actually do.

      
status
It is a pre-release built by a solo founder in Singapore. The scanner works and is tested; it has not yet been run across many real machines. Issues and detection requests are welcome.

    

  






  

    

      

        
Find the high-water mark.

        
Pick how you install. The command runs a read-only scan of the folder you are in and prints every agent's reach. Nothing leaves your machine.

      

      

        
Scan a project

        

          
          
Install with

            

              
              
            

          

          

          
          
Available on PyPI at public launch.