The scanners only make sense once the surface does.
Here’s what a 2026 product actually exposes.
Cloud config
Buckets, security groups, IAM: the classic misconfiguration surface.
Apps & APIs
The SPA in the browser, the APIs behind it, the auth boundaries between.
MCP servers
Your product’s tools are now callable by other people’s agents.
Auth flows
OAuth and OIDC: the doors between all of the above.
Supply chain
What npm and PyPI dragged in while nobody watched.
Every one of these is a place a misconfiguration lives. Most tools scan the first and call it done.
Cloud config scanner
AWS, GCP, Azure, Kubernetes, DigitalOcean cloud configuration.
Apps & APIs scanner
Deployed web apps, client-side bundles, APIs, WebSockets, DNS, BaaS, and authorization boundaries.
MCP server scanner
MCP servers and MCP client/server configurations.
Auth flow scanner
Authorization servers, relying parties, and resource servers.
Supply-chain scanner
Known npm and PyPI compromises in host files, package manifests, installed environments, and caches.
Four are live and scanning today. One is in development, with its check count printed anyway. Statuses audited 2026-08-05 against the catalogs themselves; when a status improved, the badge changed, and not before.
Each scanner sees one plane. The insight lives between them.
An endpoint your own JavaScript ships. The API scanner proves its authorization is broken. The cloud scanner shows the role behind it can read every tenant’s data.
Kloudle joins the planes on every scan and asks the question that matters: is this actually reachable, by whom, through what chain — including your agents’ tools?
The graph is small and disposable: rebuilt from snapshots on every scan, in Postgres — recursive queries, no separate graph engine. The rules that run over it are versioned, so a verdict can name the rule that produced it.
Every node keeps its native name: an ARN stays an ARN, a package is its PURL (pkg:npm/lodash@4.17.21). Only app-layer subjects get minted refs (endpoint:tenant/api-v3/POST-/users/{id}). Those URIs are the contract — the same key that lets you join your own logs.
All of it runs on one box. No Kafka. No Neo4j. No Kubernetes required. Postgres and a single binary inside your perimeter — fewer moving parts for your compliance review to clear.
It’s why the same failing check can be waived on one bucket and Critical on another. See that exact case →
Every scanner writes the same kind of finding: the observation plus the captured config that proves it.
Two check bodies are printed verbatim on the home page — the SQL of KSP10011 and the JSON of horizontal_authz.
And a line about what Kloudle does not touch: it never reads your runtime logs. Every finding carries a stable resource URI instead, so you join your own logs against it on your side of the trust boundary.
Findings from every surface, promoted on evidence, decided by you, recorded in your database.
That’s the ledger, and it’s the actual product.