A Boring Infra Co. product

Discover the paths
your agents create.

pico scan maps how untrusted influence reaches consequential authority through coding agents — locally, read-only, with evidence.

$curl -fsSL https://boringinfra.company/pico/install.sh | sh

Installs to ~/.pico/bin. Then pico init.

-// hope the agent can't reach production

+pico scan

The path is the product.

Agents are components. Attack paths are the story. Pico traces how external influence can move through tools, credentials, and infrastructure to something that matters.

Pico Scan

1 path · 5 edgesLIVE

CRITICAL·External GitHub content can reach Cloudflare production mutation authority.

Every edge needs evidence · Click a node to inspect · Synced to local SQLite

One path. Five edges. Each one needs evidence. pico scan in action.

This is all it takes.

No cloud account. No control plane. No telemetry of your graph. One curl, a local CLI, a SQLite file, and a scan you can read.

1. Install

// Installs to ~/.pico/bin
curl -fsSL https://boringinfra.company/pico/install.sh
  | sh

2. Init

// Creates .pico/pico.db
pico init

3. Scan

// Discover → graph → findings
pico scan

Your graph stays local.
There is no server.

Core discovery, persistence, analysis, and explanation run on your machine. Pico is read-only. Secrets are used transiently and never persisted. An LLM may explain a finding. It does not create one.

Your machine · Source of truth

// Local SQLite. That's the graph.
const db = ".pico/pico.db";
const secrets = "never persisted";

Workspace-scoped. Known config paths. Fingerprints only. No Pico account required.

Hosted control plane · Does not exist

// Nothing to send. Nowhere to send it.
if (cloud) return null;
if (telemetry) return "off";

No silent upload of your security graph. V0 does not need a Pico-operated backend.

Influence intersecting authority is the attack surface. Pico maps the path and shows you where to break it.

Discover. Connect.
Analyze. Explain.

Pico does not block, sandbox, or remediate. It observes the environment you already have and tells you what the graph actually says.

Discover

Coding agents, MCP servers, tools, permissions, credential references, and provider connections. Bounded scope. Known paths.

Connect

Evidence becomes a security graph: what can reach the agent, and what the agent can reach. UNKNOWN is a valid answer.

Explain

Attack paths surface as findings: the chain, the evidence, any enforced boundary, and practical cut points.

What will you find?

Anything where untrusted input can reach real authority through an agent. One coding agent with broad access is enough to have the problem.

Untrusted → production

External GitHub content reaching a Cloudflare Worker through your agent

Permission reality

What the agent can actually do, not what the README promised

Credential reachability

Which tokens the shell can touch. Fingerprints only. Never the secret.

Start mapping for real this time

Install the CLI. Initialize a workspace. The graph lives on your machine.