# What Is WarHoundAI? Our Company, Mission & Focus > WarHoundAI is a Cybersecurity AI company based in Nehtaur, Uttar Pradesh, India, dedicated to helping developers secure modern web applications. This article details our current product facts, safe test methodologies, and integration workflows. Official source: https://warhoundai.com/blog/what-is-warhoundai/ Published: 2026-10-19 Author: WarHoundAI Updated: 2026-11-12 ## A company focused on AI application security WarHoundAI was incorporated on 18 October 2026. Rajauddin Karimulla is the Founder & CEO, and the company is located in Nehtaur, Uttar Pradesh, India. Our category is Cybersecurity AI, with a product focus on autonomous application security for modern web applications. We recognize that independent developers and startups make consequential security decisions with limited time and resources. A useful security product should help them understand those decisions instead of adding complexity they cannot act on. The company name is WarHoundAI, representing our organization and product brand. Our first released service is Mini Hound, which acts as an entry point for developers needing structured security reviews. Our overarching mission is to make intelligent application security accessible to the people building modern software, particularly applications heavily reliant on generated code. Accessible means understandable findings, a clear relationship between evidence and severity, and guidance that fits the way a developer works without making unsupported claims that a tool makes software inherently secure. ## Mini Hound product capabilities and pricing Mini Hound is currently live with Free and Plus plans. The Free plan costs $0 per month and includes $1 in expiring monthly credits, providing access to the v1 model powered by Gemini 3.8 Flash. The Plus plan is priced at $4.99 per month, includes $5 in expiring monthly credits, and grants access to both the v1 model and the Pro model, which utilizes the Gemini 3.1 Pro preview through Google Cloud. Both tiers enforce hard execution budgets that users can configure as low, medium, high, or max to control resource consumption during assessments. To sustain the infrastructure required for deep reasoning and isolated environments, our credit system charges 2x the actual provider token costs, which includes all reasoning tokens generated during the analysis phases. We require a verified origin for all target applications to ensure assessments are performed only on infrastructure the customer owns or operates. Currently, standalone direct browser, search, and fetch customer tools are not yet available, reflecting our distinction between live behavior and roadmap objectives. ## Model Context Protocol integration Integration with developer environments is facilitated through an authenticated Model Context Protocol endpoint located at /api/mcp. This endpoint allows authorized clients to interact directly with Mini Hound capabilities within their existing workflows. The current implementation supports a tightly scoped set of protocol operations: account management, target configuration, security review initiation, and synthetic retest triggering. By exposing these capabilities via a standard protocol, engineering teams can build custom local tooling or integrate with compatible AI coding assistants that support external contexts. The protocol restricts access based on the verified origin requirement, meaning the endpoint will reject requests to analyze repositories or endpoints that have not been successfully authenticated as belonging to the requesting user. ## Concrete worked example: reviewing generated endpoints Consider a development team using an AI assistant to generate a document-download feature. The interface hides documents belonging to other users, but the underlying download endpoint accepts any document identifier. A developer triggers a review via the /api/mcp endpoint, passing the new routing code and the associated test fixtures as context. Mini Hound processes this input using the Gemini 3.1 Pro preview model, applying a medium execution budget. The service analyzes the source and performs bounded isolated browser checks to evaluate how the application handles session cookies when requesting mismatched identifiers. Upon detecting that the server does not enforce ownership validation, Mini Hound flags the endpoint. It outputs an evidence-backed candidate report detailing the specific payload that succeeded and the response received. Mini Hound does not provide a blanket security guarantee, nor does it automatically modify the developer's source code; it explicitly limits its output to the observed evidence and leaves the architectural remediation decision to the human engineer. ## Safe test matrix and access boundaries To prevent accidental disruption and ensure strict adherence to authorization limits, Mini Hound operates within a defined matrix of allowed and denied actions during any security review or synthetic retest. - Allowed: Public source code review of explicitly provided or configured repositories. - Allowed: Bounded isolated browser checks against verified origin targets. - Allowed: Owner-configured synthetic retests to validate the presence of a vulnerability using defined payloads. - Allowed: Outputting evidence-backed candidate vulnerabilities via the authenticated MCP endpoint. - Denied: Any form of automated exploitation or payload delivery against unverified origins. - Denied: Automatic modification or pushing of code changes to the customer's repositories. - Denied: Issuing blanket security guarantees or compliance certifications based on a review. - Denied: Executing arbitrary operating system commands outside the bounded browser isolation layer. ## Implementation tradeoffs and failure modes Deploying autonomous security agents involves structural tradeoffs. By enforcing hard execution budgets, developers gain predictable cost controls, but this introduces a failure mode where complex stateful application flows might exhaust the allocated budget before the analysis yields conclusive evidence. If a budget is exhausted midway, the review halts and returns partial findings, which requires the developer to either manually investigate the remaining surface area or increase the budget for a subsequent run. Another failure mode involves the verified origin requirement. If a developer dynamically provisions staging environments with rotating domains, the strict origin verification will block the isolated browser checks until the new domain is explicitly authorized in the dashboard. While this prevents unauthorized scanning, it adds friction to continuous integration pipelines. Furthermore, because Mini Hound relies on evidence-backed candidates rather than static pattern matching, heavily obfuscated code or non-standard authentication mechanisms may cause the agent to fail to establish a baseline session, resulting in a completed run that safely but unhelpfully reports no actionable findings. ## Sources and further reading For additional information regarding our company, leadership, and public security guides, please consult the links below. Customer support regarding billing, verified origins, or MCP integration limits can be reached through our main contact channels. Drafted with Gemini and checked for source links, advisory identifiers, structure and unsupported product claims. Examples are synthetic and are not scan results. Drafted with Gemini and checked for source links, advisory identifiers, structure and unsupported product claims. Examples are synthetic and are not scan results. - [Company details and leadership](https://warhoundai.com/about/) - [Contact WarHoundAI](https://warhoundai.com/contact/) - [Explore security guides and review templates](https://warhoundai.com/guides/)