What you are evaluating
Call-graph completeness, Bazel and monorepo support, and the difference between a free Model Context Protocol integration and an enterprise policy plane are buyer tests. Reachability can hide unused-but-shipped components that still belong on an SBOM.
A useful evaluation context
A plausible evaluation context is a monorepo team drowning in CVE volume that wants reachability and package-firewall policy, including how coding agents are governed.
Documented capabilities
The vendor describes these capabilities in the linked sources. Availability depends on the product edition and supported environment.
- Reachable software composition analysis based on call-graph context.
- Package firewall controls on what may be installed, plus container and secrets scanning as described by the vendor.
- Artificial-intelligence assisted static analysis and Model Context Protocol integration into coding agents, with policy-plane features to verify separately.
Where it fits in the work
- Analyze a lab monorepo or Bazel workspace if that is the real build, and inspect which dependencies are marked reachable.
- If a package firewall is entitled, apply it to a throwaway registry or developer install path using a known-bad lab package.
- Treat coding-agent integrations as a policy question: what the agent may fetch is not the same as what the enterprise policy plane enforces.
APPLY THE IDEA / ILLUSTRATIVE EXERCISE
Make the outcome observable.
Run Endor Labs on a lab application you own with a reachable vulnerable function and a second unused vulnerable dependency that still ships. If entitled, block a malicious-package analogue in a lab firewall policy.
Evidence to look for
The reachable issue is prioritized distinctly from the unused-but-shipped component, the unused component still appears in inventory, and any firewall block is demonstrated on the lab install path only.
Use synthetic data and an authorized test environment. Agree the scope and recovery steps before enabling enforcement.
Questions for your evaluation
- How complete is the call graph on this language and build system, including Bazel if used?
- Does reachability omit shipped-but-unused components that still require inventory?
- What is included in a free Model Context Protocol integration versus the enterprise policy plane?