SEGMENT 01 · AGENT FLIGHT CHECK · BOOKING NOW
Know what your agents are doing. In two weeks.
Agent Flight Check gives you an inventory and permission map for the agreed scope, plus ten days of hash-chained records from wrapped MCP servers. See the tool requests, server responses and coverage gaps in one readout.
THE OFFER
Two weeks. One price. Evidence you keep.
A fixed-scope diagnostic with a named deliverable and a date on it. No platform licence, no per-seat fee, no data hosted by us. How we handle your data →
FIXED PRICE · CREDITED AGAINST A BUILD$7,500 for the full Flight Check.
Credited in full against a remediation build signed within 60 days. If the review finds no issues, the report states the scope, observation period and evidence limits behind that result.
- SCOPE / One organisation, up to twelve agent or MCP endpoints in the first pass
- ACCESS / Read-only proxy inside your boundary; no credentials are given to DVC
- OUTPUT / Inventory, permission map, evidence export (JSON), findings report, remediation plan, readout
- TIME / Fourteen calendar days from install to readout
See a sample readout: findings, plan and hash-chain checks → WHAT YOU GET
Six things, all of them yours.
Delivered as files you own, in formats engineering already reads. Nothing is locked behind a login on our side.
01
Agent & MCP inventory
Every agent, model, MCP server, connector, and tool inside the agreed scope (up to twelve endpoints in the first pass), including the ones nobody remembers installing. Anything found beyond scope is listed, not audited.
02
Permission map
What each one can read, write, publish, purchase, or never touch, and who approved it, and when.
03
Ten days of records
Tool calls and server responses from wrapped MCP servers in a local, hash-chained timeline. Principals are declared, not verified. You review any export before sharing it.
04
Findings report
Risks, coverage gaps, and reliability failures, ranked, with the evidence that supports each finding.
05
Remediation plan
What to fix, in what order, with a build estimate engineering can act on the same week.
06
Leadership readout
Sixty minutes with your engineering and security leads. Questions answered from the record, not from slides.
HOW IT RUNS
Install. Record. Read out.
Two weeks is long enough to catch the weekly cadence of your agents and short enough that the answer arrives while the question is still live.
WEEK 1Install and interview
Witness is installed as a transparent proxy in front of your MCP servers and agent runtimes. We interview the owners of each agent and reconstruct the approval history.
READ-ONLY UNTIL YOU SAY OTHERWISEWEEK 2Record and analyse
Ten days of live traffic accumulate. We correlate actions against permissions, reconcile the inventory, and draft the findings.
READ-ONLY UNTIL YOU SAY OTHERWISEDAY 14Readout
Report, remediation plan, and evidence export delivered. Readout call with leadership. You keep the recorder running or switch it off.
READ-ONLY UNTIL YOU SAY OTHERWISE WHAT YOU HAND US · WHAT WE NEVER HOLD
The security packet, in one screen.
Written for the person who has to approve the install. If any line here is not true for your environment, the Flight Check does not proceed.
INSTALL
You install. We don't hold credentials.
Witness is a zero-dependency Node script you run from your own machines, wrapped around your MCP config with `witness wrap`. No agent of ours runs inside your network; no token, key, or password is ever given to us.
DATA
Local records. Reviewed exports.
Full arguments and results are hashed. Optional allow-listed summaries contain plaintext; secret-named keys are excluded, but other values can still be sensitive. Records stay local by default. Optional review and feed-sharing commands can send metadata or expose published indicators. Review an export before you send it to us.
RELAY
Transparent and fail-open.
Every frame passes through untouched. If the recorder cannot write, it says so on stderr and keeps relaying - recording can be lost, uptime cannot. Switch it off by restoring the backed-up config.
IDENTITY
Declared, not verified.
Principals are labels from your harness config, with verified: false. The record does not prove who acted or approved a call. Results reflect the server's response, not independent proof of a downstream change.
VENDOR
A name on the contract, and an instrument you can read.
Dark Vector Cognition LLC, Texas. The person who scopes the engagement runs it and stays your direct contact, with no account manager between you and the work. The recorder is Apache-2.0 on GitHub, so what runs in your environment can be read line by line before it runs.
SCOPE
Twelve endpoints. Two weeks. Fixed price.
What is found beyond scope is listed, not audited. The readout is delivered as files you own - no login on our side, no licence, nothing that stops working when the engagement ends.
Read what the recorder does, and what it refuses to claim, before you book: Witness, before you run it →
WHO IT'S FOR
Agent sprawl with a name on it.
The Flight Check is built for the person who will be asked, in a board meeting or an incident review, what the agents did - and has to answer from evidence.
YOU RUN
Claude Code, Codex, Cursor, or internal agents against production systems, and more than one team owns them.
YOU ARE
A 150–2,000-person software company - VP Engineering, Head of Platform, or CISO - being asked what the agents are doing.
YOU NEED
A defensible inventory, an evidence trail for the next incident, and a plan - not another vendor dashboard.
THE INSTRUMENT · WITNESS
Open-source, local-first, cross-vendor.
The Flight Check runs on Witness, DVC's agent flight recorder. This transparent MCP proxy writes hash-chained records of tool calls and server responses through the servers you wrap. Apache-2.0. Complete for one engineer for free; the Flight Check is where an organisation buys the reading of it.
- RECORDS / Tool, declared principal, server-reported result, local time and payload digests
- COVERAGE / Calls through wrapped MCP servers; unwrapped activity is outside the record
- CONTROL / Records calls; does not approve, block, suspend or terminate them
- VENDORS / Not locked to one model provider, one IDE, or one cloud
What Witness does and does not claim →AFTER THE READOUT
The report is the beginning, not the invoice.
A diagnostic that ends in a PDF is expensive homework. Every Flight Check ends with a costed path to fixing what it found - and you can take that path with us or without us.
BUILD · $50–200K · 4–12 WEEKS
Fix what the record found.
Permission boundaries, approval gates, agent contracts, and the evidence pipeline, built in your environment, owned by you. The $7,500 comes off the top.
OPERATE · FROM $5K / MONTH
Keep the recorder running.
Continuous recording, monthly findings, and a human who reads the chain before your auditor does. For estates that change weekly.
RE-CHECK · $500 / MONTH
Come back every year.
An annual return for estates that change slowly. We re-record for ten days and diff the result against your previous record, so the report is what changed rather than what exists: new servers, widened permissions, agents that went quiet. Between re-checks you get four hours of advisory time a quarter, answered next business day.
Re-check begins after your first Flight Check and is billed monthly, cancellable at any renewal. Incident response is scoped separately - the four hours are advisory time, not a retainer for an emergency.
TWO WEEKS · $7,500 · LOCAL RECORDS, REVIEWED EXPORTS
Book the readout call.
Thirty minutes to confirm scope and dates. If the Flight Check isn't the right instrument for your estate, we'll say so on the call.
Book the readout call →