Sold by: Quantea
Deployed on AWS
Quantea Agent Scope is an AI agent security and network traffic analysis solution that provides protocol-level visibility into Model Context Protocol (MCP) and Agent2Agent (A2A) communications. Detect suspicious agent activity, inspect tool calls, enforce security policies, and preserve packet-level evidence without requiring application SDK instrumentation. Supports flexible deployment options across AWS environments, on-premises infrastructure, Docker, bare metal, and air-gapped environments.
Overview
Quantea Agent Scope provides network-level security visibility into AI agent communications, helping enterprises monitor and secure Model Context Protocol (MCP) and Agent2Agent (A2A) traffic. It analyzes supported protocol interactions, including tool calls and delegated agent tasks, without requiring application SDK instrumentation. Built-in detection capabilities identify suspicious agent activity across nine agent-native threat classes, helping security teams investigate potential injection attempts, enumeration, data exfiltration, flooding, and rogue agents.
Agent Scope supports flexible security operations through passive network monitoring, inline inspection with configurable policy enforcement, and offline PCAP analysis. Features include agent attribution, request blocking and redaction in supported inline configurations, human approval workflows, packet-level forensics, tamper-evident audit records, and portable evidence bundles. OpenTelemetry Protocol (OTLP) integration enables telemetry export to compatible security and observability platforms, including Datadog, Splunk, and Grafana-based environments.
Designed for enterprise AI security, network traffic analysis, runtime threat detection, and AI governance, Agent Scope offers deployment flexibility across supported AWS environments, on-premises infrastructure, bare metal, Docker, and dedicated appliances, including offline and air-gapped environments. Control-mapped evidence supports workflows aligned with the EU AI Act, ISO/IEC 42001, and the NIST AI Risk Management Framework. Agent Scope helps organizations improve AI agent visibility, investigate security incidents, enforce configured policies, and maintain evidence for security and governance workflows.
Highlights
- Decodes every MCP tool call and A2A delegation that passes through the proxy and names the agent, model and user behind it. No SDK or code changes: point your agents HTTPS_PROXY at Agent Scope.
- 18 detections, including prompt injection, tool poisoning, data exfiltration and rogue agents, can block a request inline. Add redaction, tool allowlists, quotas and human approval gates per tenant or agent.
- Stays in your account. One CloudFormation stack in your VPC, evidence in S3 with Object Lock, keys in AWS KMS, optional AWS Private CA and OIDC sign-in. No agent traffic or telemetry is sent to Quantea.
Details
Sold by
Delivery method
Delivery option
Agent Scope in your VPC (CloudFormation)
Latest version
Operating system
AmazonLinux 2023
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on actual usage, with charges varying according to how much you consume. Subscriptions have no end date and may be canceled any time.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Cost/hour |
|---|---|
m6i.2xlarge | $3.29 |
m6i.xlarge | $3.29 |
c7i.2xlarge | $3.29 |
c7i.xlarge | $3.29 |
c6in.2xlarge | $3.29 |
c6in.xlarge | $3.29 |
c6i.2xlarge | $3.29 |
c6i.large | $3.29 |
c6i.xlarge | $3.29 |
Vendor refund policy
All sales are final. No refunds or credits for hourly usage, annual subscriptions (including unused time) or charges after a free trial converts to paid. Stop hourly charges by terminating your instances. Annual plans are non-cancellable and tied to one instance type. AWS infrastructure charg
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Agent Scope in your VPC (CloudFormation)
This template deploys Quantea Agent Scope into an existing VPC in your AWS account. Your AI agents send outbound HTTPS through Agent Scope, which inspects agent, MCP and A2A traffic, enforces policy, and records evidence. All data stays in your account.
Resources created:
- One EC2 instance from the Agent Scope AMI in an Auto Scaling group (minimum and maximum 1), so a failed instance is replaced automatically.
- An internal Network Load Balancer on TCP 8765 for the proxy, and an internal Application Load Balancer for the dashboard (HTTPS 443 when you supply an ACM certificate, with optional OIDC sign-in).
- A dedicated encrypted EBS gp3 data volume for the store, packet captures and logs. It is retained if the stack is deleted and reattaches when the instance is replaced.
- An S3 evidence bucket with versioning and Object Lock, encrypted with a customer managed KMS key created by the stack. Retained if the stack is deleted.
- SSM parameters for the licence and settings, a CloudWatch log group, five CloudWatch alarms, and an optional SNS topic for alarm email.
- An IAM role for the instance, limited to this stack's bucket, key, parameters and log group, plus AWS Systems Manager Session Manager access. No SSH key or inbound port 22 is required.
- A small Lambda function used only during deployment to look up the subnet's Availability Zone.
Optional: provide an ACM Private CA ARN so intercepted connections chain to a root your clients already trust. Otherwise each agent host installs the Agent Scope CA from the enrollment URL.
Requirements: an existing VPC that your agent workloads route outbound traffic through, a private subnet for the instance, subnets for the load balancers, and an Agent Scope licence key. You pay separately for the AWS resources this template creates.
CloudFormation Template (CFT)
AWS CloudFormation templates are JSON or YAML-formatted text files that simplify provisioning and management on AWS. The templates describe the service or application architecture you want to deploy, and AWS CloudFormation uses those templates to provision and configure the required services (such as Amazon EC2 instances or Amazon RDS DB instances). The deployed application and associated resources are called a "stack."
Version release notes
Signed software updates: patches are Ed25519-signed and an unsigned package is refused; install from the console with a restore point. License keys lock to your AWS account, region and CloudFormation stack, and survive instance replacement and AMI upgrades. Protected assets, Agent usage and Throughput pages with JSON and PDF export. Role checks on every write, sign-in lockout and a 12-character password minimum. Model blocking has its own Settings section. Sign-in through your identity provider no longer asks for a local password. Adds c6in and c7i instance sizes.
Additional details
Usage instructions
Quantea Agent Scope deploys into your own AWS account with the CloudFormation template in this listing. You pay for the AWS resources it creates (EC2, EBS, S3, load balancers, KMS, CloudWatch) separately from your AWS Marketplace charges.
BEFORE YOU DEPLOY
- An existing VPC that your agent workloads route outbound traffic through.
- A private subnet for the instance and subnets for the internal load balancers.
- The CIDR of your agent workloads and the CIDR your analysts browse from.
- Your Agent Scope licence key (BYOL).
- Optional: an ACM certificate for an HTTPS dashboard, OIDC details for single sign-on, and an ACM Private CA ARN.
DEPLOY
-
Launch the CloudFormation template from this listing. Fill in VpcId, AnalyzerSubnetId, LoadBalancerSubnetIds, ProxyClientCidr, DashboardCidr and LicenseKey. Leave InstanceType at c6i.xlarge unless your Installation Guide sizing says otherwise.
-
Optional parameters: CertificateArn for an HTTPS dashboard, EnableOidc and the Oidc settings for single sign-on, PrivateCaArn to issue the interception CA from your ACM Private CA, and AlarmEmail to receive CloudWatch alarms.
-
Wait for the stack to reach CREATE_COMPLETE, then open its Outputs tab.
FIRST LOGIN
-
Run the command in the InitialPasswordCommand output (AWS CLI or CloudShell) to read the one-time password.
-
Open the DashboardUrl output and sign in as admin. You must set a new password of at least 12 characters before anything else is available.
CONNECT YOUR AGENTS
-
On each agent host, set HTTPS_PROXY to the ProxyEndpoint output. Node.js global fetch ignores proxy environment variables; see Installation Guide section 6 for that case.
-
If you did not set PrivateCaArn, install the Agent Scope CA on each agent host from the EnrollmentUrl output, so intercepted connections are trusted.
-
Send a test request from an agent and confirm it appears in the dashboard.
OPTIONAL HARDENING
- To make the proxy the only path to the internet, remove the 0.0.0.0/0 route from your agent subnets and allow their outbound traffic only to the analyzer security group. Set EnforceEgressChokepoint to true to show this instruction in the stack outputs. The stack never changes your route tables itself.
OPERATING
No SSH key or inbound port 22 is needed. Use AWS Systems Manager Session Manager to reach the instance.
- Evidence (packet captures, compliance packs, store backups) is written to the bucket in the EvidenceBucketName output. The bucket and the EBS data volume are retained if you delete the stack.
- To upgrade, update the stack with the new version's AMI. The data volume reattaches to the new instance.
Documentation: Installation Guide and Administrator Guide at <link> Support: support@quantea.com
Resources
Vendor resources
Support
Vendor support
Quantea provides product support for Agent Scope to help customers with deployment, configuration, protocol compatibility, troubleshooting, and product functionality. Customers can contact our support team by email or phone for technical assistance, installation guidance, and help investigating issues related to supported MCP and A2A traffic analysis, security detection, policy enforcement, and telemetry integration.
Support Email: : support@quantea.com
Documentation : https://quantea.com/docs/agentscope-aws
Website: https://www.quantea.com
Support requests are reviewed by the Quantea team and handled according to the nature and complexity of the issue. Customers should include their product version, deployment environment, relevant logs, and a description of the issue to help expedite troubleshooting. For product inquiries, deployment planning, or enterprise support arrangements, please contact Quantea directly.
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
falcon-mcp enables seamless communication between AI agents and the CrowdStrike Falcon platform. Deployable directly onto Amazon Bedrock AgentCore, it provides programmatic access to Falcon data for agentic workflows and accelerating AI-native security automation.
VAREK checks every action an AI agent attempts against your policy before it runs. Only SATISFIED actions execute; everything else is refused at the Linux kernel boundary.
CharacterOps evaluates AI agent behavior, detects regressions, and blocks unsafe changes before approval using versioned behavior specs, test suites, scorecards, and change gates.
Tego gives enterprises runtime visibility, governance, and inline access control for AI agents, so agents get only what they need, without exposing sensitive data unrelated to their task
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.