About Salt Security
Salt Security provides security for the APIs, MCP servers and data infrastructure where agents execute. Salt describes its agentic security platform as one graph of agents, the MCP servers they use and the APIs they call, with the context behind each one. Salt states that AI agents and MCPs run on APIs. Salt Security, Inc. is a Delaware corporation with its principal place of business in Palo Alto, California. Roey Eliyahu and Michael Nicosia founded Salt in 2018.[4][8][9][10][13]
Salt covers every agent, LLM, MCP server and API, with depth into the exposure, code, configuration and runtime behind each one. Salt's Agentic Security Graph maps and correlates the full environment out-of-band. Salt delivers protection without proxying all MCP traffic through an inline gateway. Salt maps agent posture to the EU AI Act, NIST and SOC 2.[6][8][12]
Salt Surface provides agentless, outside-in discovery of MCP servers and APIs. Salt Connect provides cloud and code inventory. Salt uses collectors where runtime analysis is needed. Salt Code scans repositories and pull requests for risky API integrations, shadow MCP servers and dangerous agentic patterns before they ship. Salt discovers every agent, MCP server and tool, including shadow MCPs. Salt flags exposed endpoints, hardcoded secrets and over-scoped access. Salt detects prompt injection and context manipulation, and Salt tells legitimate agents apart from malicious bots. Salt blocks machine-speed abuse in real time.[8][9][12][13]
Salt provides one living inventory, with owners, of everything agents can reach. Salt also offers a solution to stop fraud, abuse and agent hijacking that look like valid traffic.[13]
Salt generates up-to-date specs for APIs and feeds them into application security testing tools, including SAST, DAST and IasT. Salt continuously assesses security posture compliance in CI/CD pipelines and staging. Salt compares findings to OAS and Swagger files to show where documentation and live API traffic diverge. Salt sends Jira tickets and Slack notifications directly from the Salt platform.[14]
Salt describes its deployment as starting with agentless discovery, then adding protection through the gateways, WAFs and SOC tools a customer already runs. Salt lists 40+ technology integrations across cloud, gateways, edge, code and the SOC.
Salt provides DeinDeal with an updated inventory of all its APIs and exposed sensitive data. Armis uses the dynamic reporting in Salt for compliance audits and to demonstrate FedRAMP adherence. Salt helps Navan validate the pen testing activities of its internal testers and bug bounty program.[15]
Salt Labs research into agent, MCP and API threats informs the Salt platform. The H2 2026 State of AI and API Security report examines how companies are securing AI and APIs.[2][4][9][13][15][16]
Salt Security on the record