Failure analysis for planned and existing software
Describe a planned system or add context from an existing app. CollectSEA finds real outages, breaches and AI-agent failures from systems that behaved like yours, and turns them into safeguards for you and your coding agent.
New here? Watch the one-minute tourTeams repeat the same mistakes because the lessons are scattered across postmortems, court filings and advisories. CollectSEA puts them in front of you while the design is still cheap to change. Here is the whole workflow in one minute.
Documented incidents and companies’ own SEC incident filings. Every record links to its public source and names the failure pattern.
As previously reported, on August 28, 2026 , Park Dental Partners, Inc. (“Company”) identified unauthorized access to its computer network.
Astrana Health, Inc. (the “Company”) recently became aware that its subsidiary Astrana Health Management, Inc. detected unusual activity within its environment.
As previously disclosed in a Current Report on Form 8-K filed on August 26, 2026 with the Securities and Exchange Commission, on August 25, 2026, Boston Scientific Corporation (the “ Company ”) identified a cybersecurity…
A ClickHouse access-control change made table permissions explicit, so a query without a database filter returned duplicate rows and doubled the size of the Bot Management feature file.
Safeguard: Validate generated configuration before global propagation
A latent race condition in DynamoDB's DNS management system produced an empty DNS record for the regional endpoint that the automation could not repair, so clients could not resolve the endpoint.
Safeguard: Make control-plane automation safe against stale plans
CISA reported that a self-replicating worm known as "Shai-Hulud" had compromised more than 500 npm packages.
Safeguard: Keep publishing credentials out of developer environments
AI agents
Prompt injection through a GitHub issue, a coding agent deleting a production database, a chatbot making a promise its company had to honor. CollectSEA maps each of these to the OWASP Top 10 for Agentic Applications and to the safeguards that stop them.
Where you already work
Connect the CollectSEA MCP server once and your assistant can check a design against real incidents before it writes the code. No copying and pasting.
claude mcp add --transport http collectsea https://collectsea.com/mcp{
"mcpServers": {
"collectsea": { "url": "https://collectsea.com/mcp" }
}
}curl -s https://collectsea.com/api/analyze \
-H 'Content-Type: application/json' \
-d '{"proposal":"AI agent that issues refunds via Stripe"}'Grounded in standards
NIST SP 800-53 control SA-15(8) asks developers to use threat and vulnerability information from similar systems. CollectSEA does exactly that, and links each failure pattern to OWASP, NIST, CISA and CWE.
Something else? Read about the project or send feedback from the footer.
CollectSEA (Collective Software Engineering Analogues) is a free tool that compares a description of the software or AI agent you plan to build or already run with real failures: outages, breaches and AI-agent incidents. It shows you the ones that look most like your system, and the safeguards that would have prevented them, while you plan, build or maintain it.
Yes. Choose Existing app and paste a public GitHub repository link, choose app behaviors in Quick review, or add text files. Repository imports show selected docs, config and source for you to inspect before reviewing. Your coding assistant can also inspect a repository and call analyze_existing_app through MCP. Results show behavior signals and safeguards to verify from submitted context; CollectSEA reviews selected context, never executes code, and does not scan your running app.
Threat modeling asks what could go wrong in principle. CollectSEA shows what already went wrong in systems that behaved like yours, with a link to each public source, so a design review starts from evidence instead of a blank page. It works alongside STRIDE-style threat models rather than replacing them.
Real incidents are summarized from public postmortems, regulatory filings such as SEC 8-K disclosures, court records and security bulletins, and every record links to its source. Security advisories arrive every two hours from GitHub, CISA’s Known Exploited Vulnerabilities catalog, the NIST NVD and OSV coverage of AI and agent SDKs. Every record is labelled with how much weight it can bear.
Describe what the agent reads and what it can do, for example “an assistant that reads support tickets and can query our database”, and run an analysis. If it reads untrusted text and holds powerful tools, CollectSEA shows real prompt-injection incidents with the same shape and the safeguards for each. The glossary entry on prompt injection explains the basics.
Yes. There’s a remote MCP server at https://collectsea.com/mcp that works with Claude, Cursor, VS Code, Windsurf and other MCP clients. There’s also a REST API, and one-click AGENTS.md and CLAUDE.md exports so agents follow the safeguards while they code.
No. It’s analyzed in memory and not stored on our servers. Your browser keeps a draft and cached result for the current tab; it only ends up in a URL if you create a share link. Visits are counted without cookies, using a one-way hash that changes daily and can’t identify anyone or follow them from one day to the next.
Yes. The dataset is published under CC BY 4.0, so you can use it for any purpose as long as you credit CollectSEA. Download it as JSON, CSV or JSONL from the dataset page, or query it through the API.
Yes. The website, API, MCP server and dataset are all free to use, with no account needed.
Free and open. No account needed.