Other tools
read code.
We run it.

Inner deploys AI sandboxes to prevent supply chain attacks.

Book a demo → Get early access ↓
Scroll ↓
Backed by
Y Combinator
Wired into
Claude Code · Codex · Cursor
Guards
Packages · Extensions
MCP servers · Skills
Built by students from
Harvard & MIT
The part you already know /// 01

Your agent installs faster
than you can read.

AI coding agents pick, download, and run dependencies on their own. The attack surface didn't grow. It changed hands, and the tools guarding it still work the old way.

FAILURE 01

Static scans guess

LLM code review is non-deterministic: same package, different verdict on a different day. Obfuscated payloads pass unread.

FAILURE 02

Quarantine waits

Delayed detonation holds new packages for a week and watches for community reports. You're always seven days behind every release.

FAILURE 03

Targeted attacks hide

A package aimed at one company never trips a community alarm. It waits out the quarantine, then fires on your machine only.

FAILURE 04

Alert fatigue wins

High false-positive rates train teams to click through warnings. A scanner nobody trusts is a scanner nobody reads.

How it works /// 02

Every piece of untrusted code takes
a trip to the bottom.

Once Inner is connected, every package, extension, MCP server, or skill your team or your agents request gets pulled down, tested, and judged before it ever surfaces.

0 m · surface
Stage 01 · Intercept

The gate at the surface

Packages, extensions, MCP servers, and skills: whether a developer adds one or an agent decides on its own, the request routes through Inner first. Your team keeps working the way it already works.

install requestintercepted
$ npm install jsonwebtok → routed through inner
−20 m
sandbox · isolatedobserving
✕ reads ~/.aws/credentials ✕ POST evil-metrics.xyz ✕ spawns hidden shell
Stage 02 · Detonate

Down to the sealed sandbox

The untrusted code executes in an isolated environment on our infrastructure, never yours, while Inner watches its real behavior: file access, credential reads, network calls, and shell activity.

−40 m · sandbox
Stage 03 · Verdict

Judged before execution finishes

Clean tools surface without friction. Malicious ones stay on the seafloor: refused, with the observed behaviors, the policy triggered, and a safe alternative handed back.

verdictsame install
ALLOW express BLOCK jsonwebtok safe alternative: jsonwebtoken
The industry standard is to wait a week and watch. Inner doesn't wait. // Delayed detonation catches last week's attacks. Runtime verdicts catch the one aimed at you today, in the same install.
The receipts /// 03

Autonomous installs have changed the attack surface.

1.23M+
Known malicious open-source packages to date.

454,600 new in 2025 alone.

SONATYPE, 2026 STATE OF THE SOFTWARE SUPPLY CHAIN
$80.6B
Global cost of software supply chain attacks in 2026.

+76% vs 2023.

JUNIPER RESEARCH
1 in 3
Enterprises hit by a supply chain attack in the past 12 months.

The #1 threat type.

KASPERSKY ENTERPRISE SURVEY, MARCH 2026
VS.
Static scanners
Delayed detonation
Inner
Method
Read the code, guess the intent
Quarantine a week, watch for reports
Run it now, watch what it does
Zero-days
✕ Obfuscation passes unread
✕ Newest packages unreachable for 7 days
✓ Judged the moment they're requested
Targeted attacks
✕ Looks clean until it runs
✕ Never surfaces in the waiting period
✓ Fires in our sandbox, not on your machine
Verdicts
✕ Non-deterministic
✕ Community-dependent
✓ Deterministic, from observed behavior
On block
An alert
A delay
Reasons + a safe alternative
Introducing /// the guard

Nothing gets past the crab.

Blue crabs live in the sand. So does our sandbox. Feed it a package and watch the verdict land. This is the loop that runs on every install.

 
ALLOW
REAL VERDICTS FROM THE INNER SANDBOX. THE CRAB DOES NOT READ CODE. THE CRAB WATCHES.
Privacy & data /// 04

We inspect untrusted code.
Not your code.

Security tools ask for trust, so here is the boundary, spelled out in full.

What Inner observes

  • 01 Names, versions, and sources of packages, extensions, MCP servers, and skills requested by your team and agents
  • 02 The behavior of that untrusted code inside our isolated sandboxes: file, network, and process activity
  • 03 Verdicts and the policies that produced them, for your audit trail

What Inner never touches

  • ✕ Your source code, which never leaves your machines
  • ✕ Your credentials, environment variables, or secrets
  • ✕ Your files, commits, or anything outside the install request

Verdict records are retained for your org's audit trail and nothing else. You are in secure claws. Full details in our security documentation.

FAQ /// 05

Fair questions.
Straight answers.

Is Inner another SCA or vulnerability scanner?
No. SCA tools primarily identify known vulnerabilities, licensing issues, and dependency health risks. Inner detonates packages in an isolated environment to identify dangerous runtime behavior before installation.
Will Inner break developer workflows?
Inner will only block malicious packages, enforce organizational policies, and never stand in your path. Teams can begin in observation-only mode. Inner records decisions and explains suspicious behavior without blocking installations until enforcement is enabled.
What happens when Inner blocks a package?
The developer or agent receives the package name, the observed behaviors, the policy that was triggered, and a safer alternative when available. Inner refuses to download the requested package and provides a safe alternative to use.
How is this different from delayed detonation?
Delayed detonation quarantines new packages for about a week and watches for community reports. That works for broad attacks. It also leaves you a week behind every release and fully exposed to anything aimed at your company specifically. Inner runs the package the moment it's requested and issues a verdict in the same install.
What data does Inner collect from my machines?
Install requests: package name, version, registry. Nothing else. Packages execute in our sandboxes, not on your hardware, and your source code never leaves your machines. See the privacy section above for the full boundary.
Get started /// 06

Verify what your agents install.

Early access is rolling out now. Plug Inner in before the next impostor package ships.

Talk to the founders

A FOUNDER REPLIES, USUALLY THE SAME DAY.