Every component. Every vulnerability.
Every runtime.

A build-time SBOM describes an artifact. It cannot tell you which environments are running it, or for how long. Kosli resolves the component against what is running, and the same fingerprint carries you back through the release, the build, and the commit.

• Where it runs, right now. The environments, the specific artifacts carrying it, and the repository they were built from.
• How long you were exposed. Every occurrence with the date it started and the date it stopped, so duration is a fact rather than an estimate.
• Who released it. The full evidence trail from any artifact in the answer: commit, build, approvals, and the actor who shipped it.

Scanner volume is not exposure. Counting findings tells you how much your tools produced, not how much of production is affected, or whether the situation is improving. Kosli counts what is running, by severity, against the organisational model you already keep in Kosli.

• Criticals actually in production. Not the backlog. What is running, now, filtered by severity and sliced by team, department, or environment.
• A number that holds up. Historical figures are counted as they were known at the time, so a new advisory does not rewrite last quarter and nobody has to explain why the number moved.
• Improving, or not. Exposure created and exposure closed reported separately, because a flat total hides the difference between a quiet month and thirty new exposures offset by thirty fixes.

A report of forty criticals says nothing about the artifacts carrying no scan data at all. Those read as zeroes, and the estate looks healthier than it is. Kosli reports the gaps as an answer in their own right.

• Unscanned workloads, counted. Running artifacts with no scan data, no SBOM, or no provenance, each as its own answer.
• Coverage on every number. Counts arrive with the proportion of the estate they were drawn from, so "we don't know" is visible rather than silent.
• A governance answer, not a caveat. "We cannot see this much of production" is defensible to an auditor. A false zero is not.

When a disclosure lands, the answer is usually a person joining scanner output to deployment records to Git history under time pressure, while a regulator's clock is already running. Kosli answers the same questions through the interface, the API, the CLI, and MCP.

• Your agent can ask. Over MCP, an agent asks where a component is running and follows the evidence trail to the commit and the releasing actor, without a person assembling it.
• Same answers, every surface. Interface, API, CLI, and MCP return the same result from the same record.
• Every answer dated. Results carry the timestamp of the state they describe, so nobody has to guess how current they are.