Hi, I’m Atul.
I built Zinloop so the AI assistants already on your laptops stop being invisible.

Why I’m building this

A few months ago I started noticing a pattern on friends’ and clients’ laptops. Someone had set up Claude Desktop, or Cursor, or ChatGPT, and alongside it was a small plain-text config file — mcp.json, usually — with API keys to their inbox, their code repos, their customer tools. No vault. No rotation. No inventory. Nobody at the company could tell me which laptops had these files, which systems the AI could reach, or whose keys were inside.

I run a small IT practice and talk to MSP operators every week. The pattern was the same everywhere: mid-market companies plugging AI assistants into M365, Google Drive, GitHub and Salesforce, and the people responsible for security — usually an MSP, not an in-house team — had no tool for it. Their RMM manages the device. Their EDR watches for malware. Nothing watches the agent configs. Nothing even counts them.

Every mid-market laptop is quietly becoming an identity provider for AI agents, and nobody is counting them.

The incident waiting to happen is a Claude Desktop MCP server with full-tenant M365 scopes left in a stolen laptop’s keychain. I didn’t want to wait for that incident to be the thing that started this company, so I started it now.

What Zinloop is

Three pieces, sold as one product to the MSP:

A laptop scanner — zinloop install — discovers every MCP server configured on a device, extracts the scopes and references the API keys (never the raw secret), and maps which SaaS systems each agent can touch. Windows, macOS, Linux. Runs as a service. Daily by default.

An M365 / Entra read-only connector that pulls the same picture from the cloud side: which OAuth apps hold tenant-wide consent, who granted them, which scopes they hold, and when they were last used.

An MSP console — multi-tenant, Postgres row-level security per MSP and per client — where the provider sees every one of their clients’ agent exposure in one place, gets a mail when something widens, generates a PDF audit report, and one-clicks revoke a risky M365 grant.

There’s a sidecar module — Zipax — that scores how developers use AI coding assistants and feeds a public leaderboard. It started as a honeypot to get the scanner installed on dev laptops. It’s working.

Where it is right now

About me

Atul Pokharel. Builder background, running a small IT practice with direct access to MSP operator conversations — which is how I keep hearing what’s actually breaking on the ground. I’m writing Zinloop end-to-end: the scanner in Go, the console in Next.js on Vercel, Postgres on Neon, with Claude as a day-to-day coding collaborator. The six-week velocity from first commit to live product is partly the AI stack and partly me doing nothing else right now.

I’m solo for now, and upfront about it. I’m looking for a go-to-market partner once there are paid pilots — not a technical co-founder short-term.