[XiaHua]

I'm curious how your pentesting tool handles the frequent updates in AI app behaviors and MCP APIs without overwhelming false positives?

---> Our pentest tool has a "secret" step called verification. We run a second agent to verify all the findings are "real". We have a built some pretty complex backend harness on top of our open-source mcp-xray to automate testing. If you are at the DEF CON this year, come to our demo labs and we can chat more.

Would be great to hear more about how you maintain coverage on changing AI/MCP combos without constant manual tuning. ---> It's very hard to be honest. We use agents everywhere but manual tuning is still needed.