Find the open doors before someone else does.
X1Y1 runs a read-only security review of your AWS, GCP or Cloudflare setup, plus the AI tools your team uses: coding agents like Claude Code and Codex, and MCP servers. It takes 3 working days and costs a fixed $500. You get a written list of what to fix, in priority order, and a call to go through it.
What you get
- Where the cloud money goes and what to cut
- Open access, public buckets and over-permissioned keys
- Coding agents and MCP servers that sit near production credentials
- A written list of fixes, in priority order
- A call to go through the findings with your team
Who it is for
- Startups whose developers use Claude Code, Codex, Cursor or Copilot
- Teams that connected MCP servers or agents to internal systems
- CTOs preparing for a customer security questionnaire or due diligence
Questions
How do I secure AI coding agents like Claude Code and Codex?
Treat them as privileged users. They run with the developer's access, so keep production credentials off machines that run agents, give agents short-lived scoped tokens, pin plugin versions instead of auto-updating, and review what they can reach. The review checks each of these in your setup.
Do you need write access to our cloud account?
No. The review is read-only.
How much does a security review cost?
A fixed $500 for 3 working days, including the written report and a call.
Can I check myself first?
Yes. The free AI Agent Security Check is a 12-question self-assessment that runs in your browser and tells you what to fix first.