Questions and answers
What ScopeNeat does, and what it leaves to others.
- Does ScopeNeat make us compliant with industry standards and regulations?
- No tool can. ScopeNeat produces evidence for requirements of DORA, RTS 2024/1774, NIS2, GDPR, AI Act, ISO/IEC 27001, SOC 2, PCI DSS, SWIFT CSCF, and NIST IR 8587, which your teams can use in their audits. The compliance decision stays with your auditor.
- How does ScopeNeat secure agent access at design time?
- Before an agent or an API ships, it checks which scopes each tool really needs, from the operations it calls, against 28 rules. Each rule cites its standard or guidance (OAuth RFCs, the MCP specification, OWASP) and how binding it is. Every finding names who decides, so least privilege is settled in design and kept in CI: security shifts left.
- We already have an API security tool. Why this?
- Those tools test what runs. ScopeNeat decides and records who may get which scope before it ships, and checks that what ships matches.
- Does it see our data or our traffic?
- No. It reads metadata only: scope names, operations, tool names and annotations. Never request or response bodies.
- Which identity providers does it work with?
- Any. It reads standard OpenAPI descriptions and MCP tool lists, whatever your identity provider.
- What changes for our developers?
- Little. The CLI runs in CI and fails a pull request that adds a scope or tool nobody approved.
- Can a small team use it alone?
- Yes, with a logged waiver of segregation of duties, shown on every decision it covers. For entities under DORA, it says "Not acceptable as audit evidence".
- How do we get access?
- The demo is open now, with no account. Early access opens later, on application.