Villain’s Hat is a misuse investigation tool for product teams. You give it a feature you’re planning or have just shipped and it returns a report on how people could deliberately misuse it: the paths, up to four prioritised risks, and the product decisions that would close them. It runs as an MCP inside the AI tools your team already uses, so the investigation happens in the same conversation where you’re brainstorming.
Product leaders at post-launch companies with a live user base and an engineering team: CPOs, heads of product and product managers who decide what gets built and shipped. It’s most useful where a misuse incident would cost reputation or revenue. If you’re pre-launch with no users yet, you probably have more urgent things to spend money on.
During brainstorming, before the decision is locked. The cheapest moment is when the idea is still a sentence on a call. You can investigate after shipping too, and that’s often how teams start, but the fix gets more expensive with every step between the idea and the build.
A general AI prompt can help you brainstorm what could go wrong. Villain’s Hat runs a structured investigation: it follows the person who would misuse the feature, traces how they reach the capability, and ranks what it finds by severity and how detectable each risk is. You get a decision with the reasoning behind it, not a brainstorm you then have to sort yourself.
A report listing the misuse paths found, up to four prioritised risks ranked by severity and how detectable each one is, the reasoning behind every fix-or-accept call, and the product or operational changes that would close them. Read the Markdown report in your AI app or download a PDF from the dashboard, so it can go straight into a decision doc or to your team.
Between 2 and 6 minutes to run, depending on how much context you give it. Your AI will be able to read and use the report to help you work through the recommended actions, or you can continue brainstorming with your AI and invoke Villain’s Hat again when you’ve made changes or progress. Reading the report and deciding what to change is the longer part, and that part belongs to your team.
Two free investigations to start, then three plans. Solo is €49 a month for 1 seat and 4 investigations. Team is €7,200 a year for 3 seats and 600 investigations. Founding Partner Pilots is €1,500 for four weeks with 3 seats and 90 investigations, fully credited against the annual plan. Investigations beyond your plan are €20 each. All plans include dashboard access.
A single investigation shows you one feature. The dashboard shows patterns across all of them: the same kind of risk recurring, the same area of the product getting hit, the same fix applied twice. It’s built for product leads, managers and leadership who need the trend rather than one report.
Villain’s Hat runs as an MCP inside Claude, ChatGPT, Codex and Cursor. You add the MCP connector and run investigations in your existing AI conversation. Your Villain’s Hat account gives you access to the dashboard, where you can review reports and patterns across investigations.
No to both. It receives the ask and the context your AI platform sends with the invocation, and nothing else. It doesn’t collect your workspace history, touch your codebase or change your product. The records it keeps are the ask, the context received, the agent reasoning and the results, held so investigations can be reviewed for quality. You can ask for them to be deleted.
Neither. It isn’t a penetration test and it isn’t a compliance sign-off. It’s a structured investigation of human misuse: what a motivated person could do with the capability you’re handing them. It makes the risk visible and gives you a decision to make. No tool can promise a feature is safe, and one that does is selling comfort.
Yes. Misuse is a human problem. Permissions, sharing, referrals, exports and free trials get exploited whether or not there’s a model involved. AI features can raise the stakes when the system acts on a person’s instructions, but the investigation is about what a person could do with what you’ve built.
Yes. Tell us which tool your team works in and how you’d use Villain’s Hat there. Integrations get chosen by where teams actually brainstorm, so a request from a team already using it is the best argument for building one.
Pavitra S. Tandon, who has spent 19 years in product and UX across India, New Zealand, Ireland and Serbia, and worked at McKinsey, Ryanair and Smartbox, and with Barclays as a client while at Cognizant. Pavitra created the VRSD methodology (Vector, Reachability, Severity and Detectability) and built Villain’s Hat after shutting down two earlier AI products rather than ship something that could be misused. Six practitioners across product, trust and safety, and risk and compliance have tested it over repeated beta rounds.
Have a question that’s not answered here? Email Pavitra at contact@villainhat.com.
