Governed read-only warehouse access for agents: SQL guard, row policies, PII pseudonyms, audit log.
Free
Scanned where there is a package or repository to read, and every release diffed against the tool surface we already hold.