ChainSight

Runtime agents that find a bad dependency, fix the build, sign the image, and pack the evidence.

the outliers

Ankit
Priyanka
Siddhant
Vibhawari

ChainSight

2/6

Four unknowns stop the release

A package with no owner, a CVE that never names a call site, a fix that breaks the build, and an unsigned image each hold the same ship.

Unknown components: The lockfile resolved the package. The service, the owner, and the pipeline that pulled it in were never written down.
Noisy CVEs: The advisory names a version. It does not say whether this service calls the vulnerable function.
Broken build: The upgrade that would close the finding fails the pipeline, so the release waits on a red run.
Unsigned image: The image leaves the registry with no signature, so a later check has nothing to accept or refuse.

ChainSight

3/6

Rank the call, then sign the fix

ChainSight maps the estate, ranks what running code can hit, has an agent propose the upgrade, lets Build Doctor rerun the build, signs the artifact, and packs the evidence.

Map: Versions, services, pipelines, and owners sit on one graph.
Reachability: A finding running code can hit outranks a finding nothing calls.
Proposed fix: An agent drafts the upgrade and the pull request.
Build Doctor: It classifies the failed run, repairs the break, and runs the pipeline again.
Signature: The artifact is signed so the next environment can accept or refuse it.
Evidence: The diff, the green rerun, and the attestation stay with the fix.

ChainSight

4/6

These Azure tools are on

Foundry, Cosmos, Gremlin, AI Search, Service Bus, Event Grid, Web PubSub, ACR, Key Vault, Container Apps, and Functions are on, while AKS, APIM, and Front Door stay off and Fabric is not in use.

Foundry: Hosts the agents and Ask.
Cosmos: Stores fix runs, incidents, policies, and audit rows.
Gremlin: Serves the supply-chain graph.
AI Search: Indexes inventory and findings.
Service Bus: Carries work from the API to the agents.
Event Grid: Publishes domain events after they happen.
Web PubSub: Pushes live updates to the console.
ACR: Stores the images the pipelines push.
Key Vault: Holds the keys and certificates used to sign.
Container Apps: Runs the API and the web app.
Functions: Ingests webhooks, feed polls, and schedules.

ChainSight

5/6

The public site already runs

chainsight.tomriddle.in serves the green console, the landing page, a guided demo, Entra sign-in, hosted agents, and a healthy API.

Green console: The signed-in console uses the green theme.
Landing: The public page states what the product does before sign-in.
Guided demo: The demo walks the loop from a bad dependency to an evidence pack.
Entra sign-in: People sign in with Microsoft Entra, and roles come from the token.
Hosted agents: The specialist agents run as Foundry hosted agents.
API health: The API health check responds.
chainsight.tomriddle.in: That hostname is where this build is served.

ChainSight

6/6

A private demo still needs three things

The demo network is still public, the Azure DevOps pipeline still needs a second person to approve it, and the eval sets are still too thin.

Private demo network: The walkthrough is still on a public endpoint. The next step is a private network.
Second approver: The Azure DevOps pipeline still needs a second person to approve a run before it proceeds.
Deeper eval sets: Reachability and upgrade checks need larger case sets before the scores are enough to trust.