Agent Index

npx add-mcp 'https://theagentindex.io/api/mcp'

Find the right AI agent for compliance, security and risk.

Compare 414 AI agents and platforms by framework — SOC 2, ISO 27001, HIPAA, FedRAMP, CMMC, GovRAMP, TX-RAMP, DORA, DPDP and CERT-In. Every fact links to its source; anything we could not verify is left blank.

Start here

Criteria from the open dataset — not a ranking, score or paid placement. How we verify

Has published pricing 383 listingsWhy this is here: The listing has a non-empty pricing field from a public vendor page we checked.FedRAMP-authorized 19 listingsWhy this is here: Tagged fedramp: FedRAMP Marketplace Authorized for the listed product, not platform-only.Free tier / freemium 20 listingsWhy this is here: pricing_model is freemium in the open dataset.EU-headquartered 159 listingsWhy this is here: hq_region is Europe — country of headquarters as published by the vendor.India / DPDP relevant 76 listingsWhy this is here: India headquarters, a DPDP framework tag, or a non-empty india_relevance note.

Open Dataset (DOI), MCP Server & Free GRC Tools

Open dataset

Open Dataset & DOI

414+ GRC AI agents and 518 Verified · 51 registry-listed audit firms under CC BY 4.0 (agents.json and auditors.json).

Browse /data/ · Read the State of AI Compliance & Audit report · DOI: 10.5281/zenodo.23604511 · Hugging Face Datasets · Kaggle Datasets

Read-Only MCP Server & Search API

Query Agent Index directly from Cursor, Claude Desktop, Windsurf, or any agent via https://theagentindex.io/api/mcp (search_agents, get_agent, search_auditors, get_auditor, compare_agents) and GET /api/search.

MCP setup · Try /api/search

Check an Auditor

Free accreditation lookup across 518 Verified · 51 registry-listed audit firms (ANAB, UKAS, NABCB, PCI SSC, HITRUST, FedRAMP, GovRAMP, Cyber AB, CERT-In, ISMAP, CPAverify) + change alerts.

Open the lookup · Browse the directory

Compliance Deadlines Calendar & GRC Survival Kit

Downloadable .ics compliance calendar (ISO 27001, PCI DSS v4.0.1, EU AI Act, DORA, CMMC, DPDP/CERT-In) and 5 audit-prep templates.

2025–2028 deadlines · Free GRC Survival Kit

Browse by category

All categories

See every verified listing on one page: compliance & security AI market map.

Compliance audit firms

All auditors

518 Verified · 51 registry-listed firms across 12 published country pages. This firm appears on the official registry, not independently verified by Agent Index. This is not a ranking or endorsement.

United States 223 firms with an office in United States India 138 firms with an office in India United Kingdom 61 firms with an office in United Kingdom Japan 49 firms with an office in Japan Germany 33 firms with an office in Germany Australia 29 firms with an office in Australia Netherlands 20 firms with an office in Netherlands Canada 10 firms with an office in Canada Brazil 8 firms with an office in Brazil Singapore 6 firms with an office in Singapore Ireland 5 firms with an office in Ireland United Arab Emirates 5 firms with an office in United Arab Emirates SOC 2 in the US Registry-listed SOC examination firms CERT-In in India Empanelled auditors with an India office

How it works

1. 1

   Search or filter

   Start from a framework, a category, an HQ region or a vendor name. Use Get matched for three questions, or filters on the directory. The market map shows every verified listing in one view.
2. 2

   Compare side by side

   Use Compare on a card to build a custom table of up to four listings, or open a pre-built pair or use-case table. Save a shortlist in this browser. None of them are rankings.
3. 3

   Check the sources

   Each listing shows when it was last verified and links to the vendor pages behind every fact. How we verify.

Use-case comparisons

All comparisons

AML and transaction-monitoring AI agents

58 verified listings · Anti-money-laundering, transaction monitoring and financial-crime investigation. Same table fields as pair pages; not a ranking.

KYC and identity AI agents

49 verified listings · Know-your-customer, identity verification and onboarding. Same table fields as pair pages; not a ranking.

India, Asia-Pacific and ANZ AML and KYC AI agents

7 verified listings · Anti-money-laundering screening, transaction monitoring and KYC agents from vendors headquartered in India, Asia-Pacific or Australia/New Zealand. Same table fields as pair pages; not a ranking.

AI SOC and security-analyst agents

51 verified listings · Security operations, alert investigation and threat detection. Same table fields as pair pages; not a ranking.

Email security and phishing-response AI agents

16 verified listings · Triage of user-reported phishing, autonomous email threat remediation and AI-run phishing simulation. Same table fields as pair pages; not a ranking.

AI code security agents

33 verified listings · Application security scanning, suggested or automated code fixes, and pull-request security review. Same table fields as pair pages; not a ranking.

Contract and legal-review AI agents

33 verified listings · Contract review, drafting assistance and legal workflow automation. Same table fields as pair pages; not a ranking.

Agentic pentesting AI agents

33 verified listings · Autonomous or AI-assisted penetration testing, attack-surface testing and exploitable-path verification. Same table fields as pair pages; not a ranking.

TPRM and vendor-risk AI agents

40 verified listings · Third-party risk, vendor assessments, security ratings and questionnaire automation. Same table fields as pair pages; not a ranking.

Privacy operations AI agents

15 verified listings · Privacy programme operations, DSRs, consent, data discovery and privacy assessments. Same table fields as pair pages; not a ranking.

US public-sector and FedRAMP AI agents

25 verified listings · US government, FedRAMP and public-sector compliance or security operations. Same table fields as pair pages; not a ranking.

AP and finance-automation AI agents

40 verified listings · Accounts payable, invoice and spend automation in finance back offices. Same table fields as pair pages; not a ranking.

Cloud security (CNAPP) AI agents

9 verified listings · Cloud and container security posture, exposure and remediation. Same table fields as pair pages; not a ranking.

AI governance agents and platforms

11 verified listings · AI inventory, risk assessment, policy and runtime controls for AI systems and agents. Same table fields as pair pages; not a ranking.

Identity governance AI agents

8 verified listings · Identity governance, access reviews and Conditional Access coverage. Same table fields as pair pages; not a ranking.

Enterprise agent platforms

8 verified listings · Build, orchestrate and govern AI agents for business-process automation. Same table fields as pair pages; not a ranking.

IT service-management AI agents

9 verified listings · IT service desk, employee support and service-workflow automation. Same table fields as pair pages; not a ranking.

Security questionnaire AI agents

10 verified listings · Inbound security questionnaires, SIG/CAIQ-style responses and questionnaire automation. Same table fields as pair pages; not a ranking.

Procurement and autonomous-sourcing AI agents

21 verified listings · Intake-to-award procurement, autonomous sourcing, supplier operations and procurement orchestration. Same table fields as pair pages; not a ranking.

Free guides

All guides

CERT-In CIAD-2026-0049: AI agents as attack vectors

Critical advisory of 15 Oct 2026: controls, auditor evidence, and how it sits next to the 2022 Directions and DPDP.

DPDP Act compliance checklist for teams using AI agents

Act and Rules duties with section citations, the timeline to 13 May 2027, penalties and vendor questions.

SOC 2 automation tool buyer's guide (2026)

AICPA criteria, type 1 vs type 2, auditor-independence red flags and tools compared from our dataset.

Which compliance framework do I need?

Look into common frameworks from official applicability statements. Not a ranking. Not legal advice.

Compliance cost and timeline

Vendor-published platform and pentest figures, plus a sum of the line items you select.

CERT-In empanelled auditors

How to check CERT-In’s official PDF and city counts from the verified directory. Not a ranking.

ISO 27001 certification bodies

How to check accreditation after IAF, which national register to look up, and verified bodies by country.

PCI DSS QSA companies

How PCI SSC qualifies QSA companies, what In Remediation means, and verified QSA firms by country.

HITRUST External Assessors

How HITRUST’s Authorized External Assessor list works and verified assessor firms in this directory.

FedRAMP 3PAOs

How FedRAMP recognizes assessors (A2LA) and how to verify a 3PAO. Not a ranking.

GovRAMP 3PAO list

The 32 A2LA-accredited 3PAOs listed by GovRAMP. Not a ranking.

Cybersecurity audit companies

Verified firms by framework and HQ country, plus how to verify each name on the official registry. Not a ranking.

CMMC C3PAOs

What the Cyber AB requires and how to verify a C3PAO on the Marketplace. Not a ranking.

ISMAP audit institutions

Registered auditors for Japan’s government cloud security program, from the official list. Not a ranking.

Vanta and Drata audit partners

Firms listed on Vanta’s and Drata’s partner directories, with each firm’s verified registry rows.

SOC 2 auditor FAQ

Report types, observation period, pentest as a TSC example, and how to verify a CPA or ISO certificate.

Audit-prep checklists and templates

Readiness checklists, evidence examples, policy outlines and a vendor-questionnaire kit. Working aids, not requirements.

Sharing, questionnaires and renewal

SOC 2 vs SOC 3, listed trust-center agents (alphabetical), and the ISO calendar-year audit rule.

SOC 2 to ISO/IEC 27001

Category-level overlap only, plus the official AICPA mapping spreadsheet.

Recently added

See by date added

Complicheck AI agents (AML client due diligence reports)

Complicheck (FLOWKIFY BV)

Belgium

Risk New

Belgium-based Complicheck runs a team of AI agents that turns one Belgian company number and a confirmed UBO-register extract into a source-referenced anti-money-laundering client due diligence report (ownership tree, sanctions/PEP, adverse media, risk table) for accounting firms, with the final risk decision left to the professional user.

Plinto agents (real-time financial controlling for procure-to-pay and order-to-cash)

Plinto (Plinto ApS)

Denmark

Business operations New

Copenhagen-based Plinto runs autonomous controlling agents on top of the ERP that check every purchase invoice, sales order and bank payment against contracts, orders and receipts, then act on what they find: requesting delivery confirmations or credit notes, correcting ledger entries and posting approved invoices.

USU Orchestrate ITSM (AI agents for IT service management)

USU (USU GmbH)

Germany

Business operations New

Germany-based USU launched USU Orchestrate ITSM on Oct 15, 2026: a SaaS IT service-management product built around AI agents that analyse incidents with service context, propose resolutions and take actions within granular, human-in-the-loop boundaries that decide when the agent may act alone.

Matrix42 Neo (agentic AI for service desk and employee self-service)

Matrix42 (Matrix42 GmbH)

Germany

Business operations New

Frankfurt-based Matrix42 added Neo agents to Matrix42 Professional in release 26.2 (Oct 22, 2026): they triage and enrich incoming tickets, resolve known issues automatically and document the outcome, route the rest to the likely resolver, fulfil supported employee requests end to end and execute device fixes once a service-desk agent approves.

Featured agents

Editorial picks — not paid unless labelled Sponsored.

Zania

Zania Inc.

United States

Compliance SOC 2ISO 27001HIPAA

Agentic AI platform for enterprise GRC that executes third-party risk, controls testing, evidence collection, questionnaires and gap analyses with explainability.

Snyk

Snyk

United States

Security SOC 2ISO 27001

Developer-first application security platform. Snyk Agent Fix validates AI-suggested fixes for Snyk Code findings, and the Evo Agentic AppSec agents (scanning, dependency firewall, security review, remediation and secrets) run Snyk's engines as tools. Several of these agents are still in preview.