INSPIRATION
Teams are shipping autonomous AI agents faster than they can reason about the new attack surface: prompt injection through tool output, over-broad agency, MCP poisoning, agent-to-agent impersonation. There are free scanners at one end and $50K platform engagements at the other, and nothing useful in between. AgentReady is the artifact in the middle: a $129 report a developer can buy and act on the same afternoon.
WHAT IT DOES
AgentReady grades the security readiness of an AI agent. You give it an agent or an MCP tool; it returns a score on a 0 to 10 scale, a severity band, and a prioritized, cited list of fixes. Every score comes from two published frameworks used together, OWASP AIVSS for the scoring and CSA MAESTRO for the threat model, so the number is defensible rather than an opinion. The public directory already carries readiness scores for 4,575 agents, and the site publishes 141 grounded answer pages on agent-security questions people actually search for.
HOW IT RUNS ITSELF (AI-NATIVE OPERATIONS)
The product runs itself. A visitor answers a short readiness questionnaire; the system produces a graded report with no human in the loop. No analyst reviews it, no one approves it, it ships straight to the buyer. The graded findings are generated against a Vertex AI Search corpus of security standards, so each fix cites the exact control (NIST GOVERN-1.6, OWASP LLM06, and so on) instead of inventing one. A Cloud Scheduler job wakes an agent every morning that finds unanswered high-intent questions, generates grounded pages for them, and caches the results. The content library grew from 24 to 141 pages this way without anyone writing them. The support layer, Ask Ken's AI, answers follow-up questions from the same grounded corpus with citations.
Autonomy is measured, not asserted. The scoring rubric is deterministic and published; the AI's contribution is the grounded, cited findings, which is exactly the part a human cannot do at scale across thousands of agents.
GEMINI AND GOOGLE CLOUD
The deployed app makes a real Gemini API call: a startup health probe against generateContent that gates the service and shows up at /api/healthz as gemini:live, and /ask falls back to Gemini when needed. Beyond the mandatory call, AgentReady is built almost entirely on Google Cloud: Cloud Run (serving), Vertex AI Search / Agent Builder (the grounded RAG that produces every cited finding), Firestore (leads, subscribers, reports, the agent directory), BigQuery (revenue and decision telemetry), Cloud Scheduler (the autonomous content loop), Secret Manager, and Artifact Registry. The whole thing scales to zero, so idle cost is near nothing.
REVENUE, REPORTED HONESTLY
The revenue-counting window is May 19 to Aug 17, 2026. During it, AgentReady itself charged no one: payments were left in beta while the product and its accuracy were hardened, so qualifying arms-length AgentReady revenue is $0 as of this writing. Revenue that did land on the shared Stripe account in-window (about $160, from a separate pre-existing $20/month DistributedApps product) is not AgentReady revenue and is reported separately as baseline/related-party. AgentReady's checkout is isolated by dedicated price IDs and a metadata.entity="agentready" stamp precisely so this line can be told apart with CPA-grade clarity.
The monetization is built and one switch away: three report tiers ($129 / $499 / $1,999) and a $29/month Pro plan, all wired to Stripe with a working webhook.
WHAT WE'D WANT A JUDGE TO TAKE AWAY
A working, self-operating security product built on the Google agentic stack, honest about where it is: the machine runs, the findings are grounded and cited, the cost model is near-zero, and the revenue line is switched off rather than absent by design. Turning it on is a configuration change, not a build.
Log in or sign up for Devpost to join the conversation.