# Midkernel > Midkernel is a research lab building what comes next in security and science. Our work spans security and physics. We build tools for reviewing software, study threats through public evidence, and make physical models available as simulations and learning tools. ## Security Midkernel Security builds Midkernel Scan, a security review of a repository with the full trace behind each finding, and Midkernel Threat Intel, daily trends across a curated taxonomy of threat classes from public sources. - [Security](https://www.midkernel.com/security) - [Midkernel Scan](https://www.midkernel.com/security/scan): repository reviews in limited beta. The web app shows the credit charge before every run; findings require human triage. - [Midkernel Threat Intel](https://www.midkernel.com/security/threat-intel): daily trends across a curated taxonomy of threat classes from public sources. - [Platform](https://www.midkernel.com/security/platform): read-only GitHub access, isolated sandbox runs, reports and full traces. - [Workflows](https://www.midkernel.com/security/workflows): read the public review workflows before running them. - [Evaluation](https://www.midkernel.com/security/bench): methodology and planned evaluation; no public scores yet. - [Pricing](https://www.midkernel.com/security/pricing): low, balanced and max profiles cost 10, 25 and 50 credits. One credit is US$1. Packs do not expire; purchases use native USDC on Base. - [Trust](https://www.midkernel.com/security/trust) - [Open source](https://www.midkernel.com/security/open-source) - [Changelog](https://www.midkernel.com/security/changelog) - [MCP documentation](https://www.midkernel.com/security/docs/mcp): Free public-source tools ti_sources, ti_classes, ti_daily_report, ti_latest, ti_trends, ti_get need no account or API key at https://www.midkernel.com/security/app/mcp/threat-intel (Streamable HTTP; no authentication). Discover exact source and class IDs with ti_sources and ti_classes; unknown filters return invalid_query. ti_daily_report selects the previous complete UTC day by source-effective publishedAt (publication, catalog addition, or incident), not ingestion time; default 10 findings, maximum 30. It ranks the complete eligible canonical day before selection. Priority reasons cite included source evidence and express attention, not global risk, severity, or exploitation probability. Read coverage and omission counts: unverified CISA attribution and unusable citations can exclude evidence; coverage.allD1CandidateCanonicalGroups is null when these gates exclude observations before grouping. Reports read a consistent snapshot of currently retained evidence; late arrivals and corrections can change later results. Empty results do not mean no threats. ti_latest defaults to 30 full records and supports up to 200 full or 500 summary records per page. Keep filters and format unchanged with nextCursor. Ambiguous bundles remain listable but are withheld from daily findings and excluded from threat counts with an explicit notice; totals are not complete CVE coverage. Rate limits apply; respect HTTP 429 Retry-After. The separate /security/app/mcp endpoint supports OAuth authorization code with PKCE S256 and scopes scan or threat-intel:read. Scope scan enables connect_repo, list_playbooks, start_run, fetch_run. Calling start_run debits credits immediately; there is no separate quote or confirmation step. The primary Security contact is mailto:hello@midkernel.com. Public signup is not advertised. No sample report is published yet. This marketing site has no public REST API of its own. Current MCP endpoint and issuer details are in the [endpoint directory](https://www.midkernel.com/.well-known/mcp) and the documentation above; no root OpenAPI or OIDC contract is advertised. ## Physics Explore physical models through interactive simulations and learning tools. Our current work covers astronomy and quantum physics. - [Physics](https://www.midkernel.com/physics) - [Astronomy](https://www.midkernel.com/physics/astronomy): Solar System and black-hole models, with scientific notes and versioned releases. - [Quantum Worlds](https://www.midkernel.com/physics/quantum-worlds): browser labs and an offline app being developed for iPhone and iPad. - [Quantum Worlds support](https://www.midkernel.com/physics/quantum-worlds/support) Quantum Worlds is in TestFlight beta testing and is not available in the App Store. Scientific models have assumptions and limitations; read the notes alongside each lab. ## Shared pages - [Research](https://www.midkernel.com/research): Read our research, methods and technical notes. Articles retain their root research URLs and identify their vertical. Existing published articles are Security research. - [Careers](https://www.midkernel.com/careers): seven Security roles and three Physics roles. - [About](https://www.midkernel.com/about) - [Contact](https://www.midkernel.com/contact): mailto contact, without a website form. - [Privacy](https://www.midkernel.com/legal/privacy), [Terms](https://www.midkernel.com/legal/terms), [Security DPA](https://www.midkernel.com/legal/dpa) ## Machine-readable pages - [API catalog](https://www.midkernel.com/.well-known/api-catalog): the live MCP services and their descriptions. - [MCP server card](https://www.midkernel.com/.well-known/mcp/server-card.json): the public Threat Intel server and its actual capabilities. - [Agent Skills](https://www.midkernel.com/.well-known/agent-skills/index.json): usage instructions with SHA-256 artifact digests. - [Agentic resource catalog](https://www.midkernel.com/.well-known/ai-catalog.json) - [Authentication instructions](https://www.midkernel.com/auth.md): public access and the existing OAuth issuer's registration flow. - [Research RSS](https://www.midkernel.com/rss.xml) - [Security changelog RSS](https://www.midkernel.com/security/changelog/rss.xml) - [Sitemap](https://www.midkernel.com/sitemap.xml) - [Full text](https://www.midkernel.com/llms-full.txt) Website-owned content pages also have a text/markdown representation at the same URL with Accept: text/markdown, or below /raw. This does not apply to the separate Security app, Physics runtimes, release assets or native share handler. Public canonicals use https://www.midkernel.com, never a preview deployment URL. On browsers supporting WebMCP, search_midkernel_research searches published research titles and summaries and returns article URLs. It reads public content without starting a Scan or spending credits. The public website permits search and AI inference use through Content Signals in robots.txt and opts out of AI training.