We don’t stop at reading code.
We run it.
Inner deploys AI sandboxes to prevent supply chain attacks. Built by a team of Harvard and MIT engineers.
Backed by Y CombinatorSits inside the tools your team already uses
Connect in one click
One command puts Inner between your agent and the registry.
Inner intercepts every install, whether an agent or a human runs it.
Trust is becoming scarce
Supply chain attacks have been around since the mid-80s; it’s an issue that has caused every developer nightmares. In this AI era, agents have only made the issue worse. Over the past few months alone, the LiteLLM, GitHub, and the NPM Axios breaches affected millions of developers and executives.
We believe that the open-source dependency model was built for a world where code was scarce, so importing a stranger’s package was the only affordable way to build. That world is ending. Code is no longer a limiting factor, and trust is becoming the scarce resource.
We think the coming years belong to teams that own their software supply chain end to end, where everything that runs in their environment earned its place by observed behavior, not reputation.
This is especially important for a world where agents start making their own tool calls, touching files, shells, credentials, and networks. Trusting a point-in-time scan no longer holds up. Security has to follow the code into execution, and this starts by owning your software supply chain. Inner is the gate where that starts.
Autonomous installs have changed the attack surface.
FAQ
Is Inner another SCA or vulnerability scanner?
No. SCA tools primarily identify known vulnerabilities, licensing issues, and dependency health risks. Inner detonates packages in an isolated environment to identify dangerous runtime behavior before installation.
Will Inner break developer workflows?
Inner will only block malicious packages, enforce organizational policies, and never stand in your path. Teams can begin in observation-only mode. Inner records decisions and explains suspicious behavior without blocking installations until enforcement is enabled.
What happens when Inner blocks a package?
The developer or agent receives the package name, the observed behaviors, the policy that was triggered, and a safer alternative when available. Inner refuses to download the requested package and provides a safe alternative to use.
Inner is built by Issa, Firas, and Ibrahim, and backed by Y Combinator. We’re early, and we work directly with the people using Inner.
Talk to the foundersVerify what your agents install.
Early access is rolling out now. Plug Inner in before the next impostor package ships.