Agent Index

npx add-mcp 'https://theagentindex.io/api/mcp'

Find the right AI agent for compliance, security and risk.

Compare 427 AI agents and platforms by framework — SOC 2, ISO 27001, HIPAA, FedRAMP, CMMC, GovRAMP, TX-RAMP, DORA, DPDP and CERT-In. Every fact links to its source; anything we could not verify is left blank.

Start here

Criteria from the open dataset — not a ranking, score or paid placement. How we verify

Has published pricing 396 listingsWhy this is here: The listing has a non-empty pricing field from a public vendor page we checked.FedRAMP-authorized 19 listingsWhy this is here: Tagged fedramp: FedRAMP Marketplace Authorized for the listed product, not platform-only.Free tier / freemium 20 listingsWhy this is here: pricing_model is freemium in the open dataset.EU-headquartered 159 listingsWhy this is here: hq_region is Europe — country of headquarters as published by the vendor.India / DPDP relevant 77 listingsWhy this is here: India headquarters, a DPDP framework tag, or a non-empty india_relevance note.

Open Dataset (DOI), MCP Server & Free GRC Tools

Open dataset

Open Dataset & DOI

427+ GRC AI agents and 521 Verified · 100 registry-listed audit firms under CC BY 4.0 (agents.json and auditors.json).

Browse /data/ · Read the State of AI Compliance & Audit report · DOI: 10.5281/zenodo.23604511 · Hugging Face Datasets · Kaggle Datasets

Read-Only MCP Server & Search API

Query Agent Index directly from Cursor, Claude Desktop, Windsurf, or any agent via https://theagentindex.io/api/mcp (search_agents, get_agent, search_auditors, get_auditor, compare_agents) and GET /api/search.

MCP setup · Try /api/search

Check an Auditor

Free accreditation lookup across 521 Verified · 100 registry-listed audit firms (ANAB, UKAS, NABCB, PCI SSC, HITRUST, FedRAMP, GovRAMP, Cyber AB, CERT-In, ISMAP, CPAverify) + change alerts.

Open the lookup · Browse the directory

Compliance Deadlines Calendar & GRC Survival Kit

Downloadable .ics compliance calendar (ISO 27001, PCI DSS v4.0.1, EU AI Act, DORA, CMMC, DPDP/CERT-In) and 5 audit-prep templates.

2025–2028 deadlines · Free GRC Survival Kit

Browse by category

All categories

AI agent security and governance 19 tools that secure or govern AI agents · separate catalog

See every verified listing on one page: compliance & security AI market map.

Compliance audit firms

All auditors

521 Verified · 100 registry-listed firms across 12 published country pages. This firm appears on the official registry, not independently verified by Agent Index. This is not a ranking or endorsement.

United States 254 firms with an office in United States India 153 firms with an office in India United Kingdom 61 firms with an office in United Kingdom Japan 49 firms with an office in Japan Germany 33 firms with an office in Germany Australia 30 firms with an office in Australia Netherlands 21 firms with an office in Netherlands Canada 10 firms with an office in Canada Brazil 8 firms with an office in Brazil Singapore 6 firms with an office in Singapore United Arab Emirates 6 firms with an office in United Arab Emirates Ireland 5 firms with an office in Ireland SOC 2 in the US Registry-listed SOC examination firms CERT-In in India Empanelled auditors with an India office

How it works

1. 1

   Search or filter

   Start from a framework, a category, an HQ region or a vendor name. Use Get matched for three questions, or filters on the directory. The market map shows every verified listing in one view.
2. 2

   Compare side by side

   Use Compare on a card to build a custom table of up to four listings, or open a pre-built pair or use-case table. Save a shortlist in this browser. None of them are rankings.
3. 3

   Check the sources

   Each listing shows when it was last verified and links to the vendor pages behind every fact. How we verify.

Use-case comparisons

All comparisons

AML and transaction-monitoring AI agents

58 verified listings · Anti-money-laundering, transaction monitoring and financial-crime investigation. Same table fields as pair pages; not a ranking.

KYC and identity AI agents

49 verified listings · Know-your-customer, identity verification and onboarding. Same table fields as pair pages; not a ranking.

India, Asia-Pacific and ANZ AML and KYC AI agents

7 verified listings · Anti-money-laundering screening, transaction monitoring and KYC agents from vendors headquartered in India, Asia-Pacific or Australia/New Zealand. Same table fields as pair pages; not a ranking.

AI SOC and security-analyst agents

52 verified listings · Security operations, alert investigation and threat detection. Same table fields as pair pages; not a ranking.

Email security and phishing-response AI agents

16 verified listings · Triage of user-reported phishing, autonomous email threat remediation and AI-run phishing simulation. Same table fields as pair pages; not a ranking.

AI code security agents

37 verified listings · Application security scanning, suggested or automated code fixes, and pull-request security review. Same table fields as pair pages; not a ranking.

Contract and legal-review AI agents

33 verified listings · Contract review, drafting assistance and legal workflow automation. Same table fields as pair pages; not a ranking.

Agentic pentesting AI agents

35 verified listings · Autonomous or AI-assisted penetration testing, attack-surface testing and exploitable-path verification. Same table fields as pair pages; not a ranking.

TPRM and vendor-risk AI agents

42 verified listings · Third-party risk, vendor assessments, security ratings and questionnaire automation. Same table fields as pair pages; not a ranking.

Privacy operations AI agents

15 verified listings · Privacy programme operations, DSRs, consent, data discovery and privacy assessments. Same table fields as pair pages; not a ranking.

US public-sector and FedRAMP AI agents

25 verified listings · US government, FedRAMP and public-sector compliance or security operations. Same table fields as pair pages; not a ranking.

AP and finance-automation AI agents

43 verified listings · Accounts payable, invoice and spend automation in finance back offices. Same table fields as pair pages; not a ranking.

Cloud security (CNAPP) AI agents

9 verified listings · Cloud and container security posture, exposure and remediation. Same table fields as pair pages; not a ranking.

AI governance agents and platforms

11 verified listings · AI inventory, risk assessment, policy and runtime controls for AI systems and agents. Same table fields as pair pages; not a ranking.

Identity governance AI agents

8 verified listings · Identity governance, access reviews and Conditional Access coverage. Same table fields as pair pages; not a ranking.

Enterprise agent platforms

8 verified listings · Build, orchestrate and govern AI agents for business-process automation. Same table fields as pair pages; not a ranking.

IT service-management AI agents

11 verified listings · IT service desk, employee support and service-workflow automation. Same table fields as pair pages; not a ranking.

Security questionnaire AI agents

10 verified listings · Inbound security questionnaires, SIG/CAIQ-style responses and questionnaire automation. Same table fields as pair pages; not a ranking.

Procurement and autonomous-sourcing AI agents

21 verified listings · Intake-to-award procurement, autonomous sourcing, supplier operations and procurement orchestration. Same table fields as pair pages; not a ranking.

Japanese accounting and AP AI agents

4 verified listings · Accounts payable, invoice and receipt collection, and accounting-document automation from vendors headquartered in Japan. Same table fields as pair pages; not a ranking.

Threat intelligence AI agents

6 verified listings · Cyber threat intelligence: collecting, analysing and acting on threat-actor, dark-web and indicator intelligence. Same table fields as pair pages; not a ranking.

Free guides

All guides

CERT-In CIAD-2026-0049: AI agents as attack vectors

Critical advisory of 15 Oct 2026: controls, auditor evidence, and how it sits next to the 2022 Directions and DPDP.

DPDP Act compliance checklist for teams using AI agents

Act and Rules duties with section citations, the timeline to 13 May 2027, penalties and vendor questions.

SOC 2 automation tool buyer's guide (2026)

AICPA criteria, type 1 vs type 2, auditor-independence red flags and tools compared from our dataset.

Which compliance framework do I need?

Look into common frameworks from official applicability statements. Not a ranking. Not legal advice.

Compliance cost and timeline

Vendor-published platform and pentest figures, plus a sum of the line items you select.

CERT-In empanelled auditors

How to check CERT-In’s official PDF and city counts from this directory. Not a ranking.

ISO 27001 certification bodies

How to check accreditation after IAF, which national register to look up, and verified bodies by country.

PCI DSS QSA companies

How PCI SSC qualifies QSA companies, what In Remediation means, and Verified and registry-listed QSA firms by country.

HITRUST External Assessors

How HITRUST’s Authorized External Assessor list works and Verified and registry-listed assessor firms in this directory.

FedRAMP 3PAOs

How FedRAMP recognizes assessors (A2LA) and how to verify a 3PAO. Not a ranking.

GovRAMP 3PAO list

The 32 A2LA-accredited 3PAOs listed by GovRAMP. Not a ranking.

Cybersecurity audit companies

Verified firms by framework and HQ country, plus how to verify each name on the official registry. Not a ranking.

CMMC C3PAOs

What the Cyber AB requires and how to verify a C3PAO on the Marketplace. Not a ranking.

ISMAP audit institutions

Registered auditors for Japan’s government cloud security program, from the official list. Not a ranking.

Vanta and Drata audit partners

Firms listed on Vanta’s and Drata’s partner directories, with each firm’s verified registry rows.

SOC 2 auditor FAQ

Report types, observation period, pentest as a TSC example, and how to verify a CPA or ISO certificate.

Audit-prep checklists and templates

Readiness checklists, evidence examples, policy outlines and a vendor-questionnaire kit. Working aids, not requirements.

Sharing, questionnaires and renewal

SOC 2 vs SOC 3, listed trust-center agents (alphabetical), and the ISO calendar-year audit rule.

SOC 2 to ISO/IEC 27001

Category-level overlap only, plus the official AICPA mapping spreadsheet.

Recently added

See by date added

Commugen AI agents for cyber GRC (AI Evidence Analysis, AI Compliance Auditor, AI Cyber Risk Quantification and more)

Commugen (Commugen Ltd)

Israel (registered office)

Compliance ISO 27001 New

No-code cyber GRC platform that launched a portfolio of AI agents on Oct 27, 2026: they review supplier evidence and questionnaires, verify supplier entities and recommend accept/reject statuses with a score, map findings to controls, draft policies, break down pen-test reports, quantify cyber risk in money terms and turn findings into owned tasks, with a named human signing off on consequential decisions.

RAKUS 楽楽電子保存 証憑取得AIエージェント (invoice and receipt collection agent for Japan's Electronic Books Maintenance Act)

RAKUS (株式会社ラクス, RAKUS Co., Ltd.)

Japan

Business operations New

Tokyo-based RAKUS's evidence-collection AI agent for its 楽楽電子保存 e-bookkeeping system finds invoices and receipts that arrive by email, unlocks password-protected files and ZIPs using passwords it extracts from other emails, registers them in 楽楽電子保存, checks Electronic Books Maintenance Act (電子帳簿保存法) requirements and alerts staff on errors; since Oct 27, 2026 it can read Microsoft 365 mailboxes directly.

Cymulate Cowork and Vero AI agents (agentic exposure validation and cyber defense engineering)

Cymulate (Cymulate Ltd)

Israel (registered office)

Security New

Agentic extension to the Cymulate exposure-validation platform: a squad of agents (Threat Profiler, Defense Optimizer, Posture Strategist, Validation Analyst, Validation Operator, Red Teamer) takes a plain-language objective, builds and runs threat-informed attack-simulation assessments on demand or on a schedule, and drives mitigation, re-testing, ticketing and reporting across SIEM, EDR and ITSM tools, with optional human approval.

KELA Digital CTI Analysts (Alex and Ethan agentic threat-intelligence analysts)

KELA (Kela Research and Strategy Ltd.)

Israel (registered office)

Security New

Always-on agentic threat-intelligence analysts trained on KELA's cybercrime data lake: Alex (enterprises and MSSPs) and Ethan (government and law enforcement) monitor the organisation's threat landscape 24/7, prioritise and proactively surface leaked credentials, targeted threats and threat-actor profiles, answer analyst questions and generate RFIs, working inside existing tools via API, MCP, webhooks and a built-in SOAR.

Featured agents

Editorial picks — not paid unless labelled Sponsored.

Zania

Zania Inc.

United States

Compliance SOC 2ISO 27001HIPAA

Agentic AI platform for enterprise GRC that executes third-party risk, controls testing, evidence collection, questionnaires and gap analyses with explainability.

Snyk

Snyk

United States

Security SOC 2ISO 27001

Developer-first application security platform. Snyk Agent Fix validates AI-suggested fixes for Snyk Code findings, and the Evo Agentic AppSec agents (scanning, dependency firewall, security review, remediation and secrets) run Snyk's engines as tools. Several of these agents are still in preview.