Stacklok

Stacklok: AI & Open Source Supply Chain Security

Stacklok is AI and open-source supply chain security platform. AI coding tools have raced ahead of security tooling — engineers paste secrets into AI prompts and accept completions that pull in untrusted open-source packages. Stacklok's pitch is the security layer for the AI coding era: CodeGate intercepts risky AI completions, Trusty evaluates open-source packages, Minder enforces supply-chain policy — by the team that brought Kubernetes to production.

Key Features

• AI and open-source supply chain security platform
• Founded in 2023 by Craig McLuckie (Heptio co-founder, Kubernetes co-creator) and Luke Hinds
• Approximately $17.5M Series A; backed by Madrona Venture Group and Index Ventures
• Minder is the open-source policy engine for software supply chain configuration
• CodeGate sits between developers and AI coding tools to prevent secret leakage and risky completions
• Trusty evaluates open-source packages for trustworthiness and supply-chain risk
• Used by engineering organizations adopting AI coding tools and managing open-source dependencies

Ideal Use Case

Engineering organizations that have rolled out AI coding tools (Cursor, Copilot, Cline) and now need guardrails against secret leakage, risky completions, and untrusted open-source dependencies — particularly companies in regulated industries.

Why Use Stacklok

AI coding tools have raced ahead of security tooling — engineers paste secrets into AI prompts and accept completions that pull in untrusted open-source packages. Stacklok's pitch is the security layer for the AI coding era: CodeGate intercepts risky AI completions, Trusty evaluates open-source packages, Minder enforces supply-chain policy — by the team that brought Kubernetes to production.

FAQ

Q: Who founded Stacklok? A: Craig McLuckie (Heptio co-founder and Kubernetes co-creator) and Luke Hinds co-founded Stacklok in 2023.

Q: How much has Stacklok raised? A: Approximately $17.5M Series A with Madrona Venture Group and Index Ventures participating.

Q: What is CodeGate? A: CodeGate is Stacklok's product that sits between developers and AI coding tools (Cursor, Copilot, Cline) to prevent secret leakage and risky completions before they reach the AI provider.

Q: What is Minder? A: Minder is Stacklok's open-source policy engine for software supply-chain configuration — enforcing policies across repositories, dependencies, and CI/CD pipelines.

Q: Stacklok vs Snyk vs Endor Labs? A: Snyk and Endor Labs focus on traditional code and dependency security. Stacklok's differentiation is the AI-coding angle — CodeGate intercepts risky AI completions, which traditional security tools weren't built to handle.

tl;dr

Stacklok is the AI and open-source supply-chain security company founded by Heptio co-founder Craig McLuckie. ~$17.5M Series A; Madrona + Index Ventures-backed. CodeGate intercepts risky AI completions; Trusty evaluates packages; Minder enforces policy.

Related

Looking for more options? Browse the Security & Governance directory or read our best AI security tools listicle. Stacklok is also tracked on Crunchbase.