--- title: "Anomity | Agentic AI Security for Agents, MCPs & Browsers" description: "Shadow AI is everywhere. Anomity discovers it across endpoint, browser and cloud, then enforces policy on every tool call before it runs." url: "https://anomity.ai/" source: html --- Agentic AI Security # Shadow AI is everywhere. Now you can govern it. Discovery across endpoint, browser, and cloud. **Policy enforced on every tool call, before it runs.** [Get a demo](#early-access) [See how it works →](#how-it-works) [**Cyber Verification** Anthropic · Verified](https://anomity.ai/blog/anomity-anthropic-cyber-verification-program/) [**Partner Network** Claude · Member](https://claude.com/partners) [**For Startups** Claude · Member](https://claude.com/startups) [**Collective Cyber Defense** OpenAI · Signatory](https://openai.com/collective-cyberdefense/) 88% Security leaders use shadow AI 82% Enterprises now run AI agents 53% MCP servers hold static secrets 21% Can actually see their agents 69% Suspect banned GenAI use 12% Call AI governance mature 8.5% MCP servers use OAuth 88% Security leaders use shadow AI 82% Enterprises now run AI agents 53% MCP servers hold static secrets 21% Can actually see their agents 69% Suspect banned GenAI use 12% Call AI governance mature 8.5% MCP servers use OAuth Industry research, 2025. Sources: UpGuard, Akto, Astrix, Gartner. [Inventory](#features)[Policies](#runtime-governance)[Audit](#outcomes) LIVE 47 Agents 124 MCPs 318 Extensions 62 AI sites 14 Personal accts 11 Findings ! **dev-macbook-14** plaintext secret in `settings.json` 2m ⛔ **ops-laptop-22** denied `Bash(rm -rf)` at the hook 5m ⛔ **fin-win-08** blocked `aws-key` pasted into an AI site 9m ! **sales-mac-11** personal account signed into `chatgpt.com` 14m ✓ **data-mac-03** hook `PreToolUse` matches policy 18m [### Cyber Verification Program Approved by Anthropic for defensive security work that needs dual-use model capability.](https://anomity.ai/blog/anomity-anthropic-cyber-verification-program/) [### NVIDIA Inception Program Anomity is a member of the NVIDIA Inception program, which supports startups building with AI.](https://www.nvidia.com/en-us/startups/) [### Collective Cyber Defense A signatory of OpenAI’s open letter calling for urgent, collective action on cyber defense.](https://openai.com/collective-cyberdefense/) [Claude](#features) [ChatGPT](#features) [Copilot](#features) [Gemini](#features) [Perplexity](#features) [Ollama](#features) [Hugging Face](#features) [GitHub](#features) [GitLab](#features) [JetBrains](#features) [VS Code](#features) [Cursor](#features) Coverage ## Every AI tool your team already runs . 144 AI tools and 311 AI web services, classified. Anomity discovers the agents, MCP servers and extensions installed on your fleet, and the AI services your people reach in a browser tab, including the ones nobody told you about. 01 § 01 / The blind spot ## Shadow AI is already on every managed endpoint . AI tools arrived faster than the security program was designed to cope with. Most teams cannot answer the simplest question about any of it. Ungoverned AI agents Claude, ChatGPT, Cursor, Copilot, Cline, Windsurf, and peers. Each has its own permission model. None report to you. The surface on every agent Plugins, skills, hooks, CLIs, IDE extensions. Each loads into an agent and carries its own permissions. Nothing is inventoried. Unknown MCP servers Wired in from public registries. They run with filesystem, shell, and network access, and are never reviewed. Secrets in plaintext API keys, database URLs, JWTs, private keys. Sitting in config files any loaded agent or plugin can read. Blanket permission grants Rules like `Bash(*)` or `Write(*)` hand the machine over to whatever prompt is running. Personal accounts doing corporate work A consumer AI account in a browser tab is outside your IdP, your DPA, your retention policy and your offboarding. You cannot revoke what you never issued. Agents running unsupervised An agent started in an unattended mode acts without asking. That mode is a process argument: it writes nothing to disk, so nothing that scans files sees it. Cloud AI you never approved One employee clicks Allow and a third-party AI tool holds Drive, Gmail or repo scopes. Nothing lands on a laptop, so no endpoint control sees it. No change history "What was installed or modified last Thursday?" is a forensics engagement, not a query. 02 § 02 / What Anomity surfaces ## One live governance layer for AI on your fleet. Twelve AI surfaces across three collectors: everything loaded into an agent on a managed endpoint, everything your people reach in a browser tab, and everything holding a grant on your cloud tenant, plus the runtime controls to govern what they're allowed to do. ### AI Agents Claude, ChatGPT, Cursor, Copilot, Gemini, Cline, and peers, grouped by device and vendor. ### MCP Servers Classified as official, community, or unknown, with the capabilities each one grants. ### IDE Extensions Every AI-related extension across VS Code, Cursor, JetBrains, and peers. ### Skills Skill packs and instruction files loaded into agents, with their content scanned on the device for risky behavior. ### Plugins Third-party plugins extending agent behavior, including the ones nobody told you about. ### Secrets API keys, database URLs, JWTs, private keys, redacted on the endpoint before they leave the machine. ### Hooks Pre-prompt, post-tool, and event hooks, the point where Anomity enforces policy on tool calls in real time. ### CLIs AI-enabled command-line tools, wrappers, and shims that invoke agents outside the IDE. ### AI Sites & Sign-ins 311 classified AI web services, the accounts signed into each, and whether those accounts are corporate or personal. ### Local LLM Runtimes Ollama, LM Studio, Jan, and Docker Model Runner, with the model weights sitting on each machine. ### Browser Extensions Every extension in a managed browser, with its permissions and host access, and the AI ones called out. ### Cloud AI Apps Third-party AI applications holding OAuth grants on your tenant, scored by the scopes they were granted. **Coverage expands as the ecosystem does.** 144 AI tools, 311 AI web services, and 162 credential formats today. New surfaces are added as they emerge, the product grows with the threat surface. 03 § 03 / Three collectors ## The endpoint, the browser, and the grant on your tenant . Some of what matters never touches disk. Three collectors cover it: the live session on the endpoint, the AI services your people reach in a tab, and the third-party apps holding OAuth grants on your tenant. Endpoint ### The agent nobody was supervising A session started in an unattended mode raises a finding while it is still running. That is the only way to see the mode at all: it is a process argument that writes nothing to disk. Anomity also catches an agent that gains an MCP server or a permission mid-session, the endpoint signature of prompt-injection persistence. Browser ### The AI your people open in a tab A managed Chrome and Edge extension covers 311 classified AI web services: which get used, the accounts signed into them (corporate, personal, or another company's tenant), and the credentials pasted *or typed* into them. It can redact or block on the way in. [See the Browser Sensor](https://anomity.ai/browser-sensor/). Cloud ### The AI holding a grant on your data Read-only connectors to Google Workspace and GitHub find third-party AI applications carrying OAuth scopes on your tenant, rate those scopes for sensitivity and personal-data exposure, name which of your people granted each one, and revoke them from the console. Three collectors, one console. Endpoint, browser, and cloud findings share the same severity model, the same open to acknowledged to resolved workflow, and the same 90-day audit trail. 04 § 04 / What it does for you ## Visibility, enforcement, and proof. In that order. You don't need another dashboard. You need three specific outcomes. 01 ### A live inventory of every AI artifact in your organization. One screen, updated in real time as employees install, configure, sign in, and change things. Uninstalled tools drop out rather than lingering, and the spreadsheet nobody could keep current stops mattering. 02 ### Active enforcement, not just visibility. Define rules (no blanket `Bash(*)`, only approved MCPs, no plaintext secrets) and Anomity *enforces* them at the agent hook: each tool call gets an allow or deny decision *before it executes*, and violations are blocked on the spot. Works on every agent that exposes a hook. Denies route to SIEM, Slack, email, and Jira. 03 ### An answer when something goes wrong. A 90-day audit trail of every added, removed, or modified MCP, permission, extension, plugin, skill, and hook, in plain language rather than a field diff, alongside the runtime record of which sessions ran unattended and what an agent installed. "What changed last Thursday?" becomes a single query, not a forensics engagement. 05 § 05 / Runtime agent governance ## Allow the safe. Deny the dangerous. Log it all. Anomity runs as a hook handler on the agent: on every tool call, MCP tools, shell, files, and network alike, it inspects the invocation, evaluates it against your policy, and returns allow or deny before the tool runs. Allow ### Compliant calls run untouched Safe, in-policy tool calls are approved at the hook and run without interrupting the developer, no prompts, no blocks, no sandboxes. Deny ### Violations stopped before they execute When a call violates policy (an MCP tool from an unapproved server, a write to a protected path), Anomity returns a deny at the hook, before it runs. Only the violating call is stopped. Log ### Every decision on the record Each tool call that reaches the policy engine is logged with its allow/deny decision, building a queryable 90-day audit trail. Anomity runs wherever an agent exposes a hook interface. On Claude Code, for example, it handles the `PreToolUse` event, which fires on every tool call in the agentic loop, and returns an allow or deny decision. The same per-tool-call governance extends across the agents your fleet runs: not a network proxy, not a sandbox, never a blocked workflow. 06 § 06 / Discovery & enforcement engine ## Lightweight sensors. Deep discovery. Real-time enforcement. ### Discover & enforce - One-pass inventory of twelve AI surfaces: agents, MCPs, extensions, plugins, skills, secrets, hooks, CLIs, local models, AI sites, sign-in accounts, and cloud AI grants. - Trust classification of every artifact as official, community, or unknown, from vendor, command, and fingerprint signals. - Capability mapping per artifact: what can reach the filesystem, shell, network, or credentials. - Blocking at the agent hook: every tool call gets an allow or deny decision before it runs. - Content scanning on the device for skills and instruction files, returning a rule id and a severity, never the text it matched. - Real-time change detection: every install, config edit, permission grant, and AI sign-in, across the fleet. - Decision routing to SIEM, Slack, email, and Jira as it happens. ### Trust by design - SOC 2 Type II attested. - Secrets stay on the endpoint. - Strict tenant isolation at the query layer. - Per-device credentials , bcrypt at rest. - Metadata only. Not source, not prompts. - 90-day audit retention , longer on request. - Compliance mapping to SOC 2, ISO 42001/42005, NIST AI RMF, the EU AI Act, and OWASP LLM Top 10. - CycloneDX AI bill of materials , fleet-wide or per device. **Endpoint** Windows · macOS · Linux ↓ **Endpoint Sensor** discovers every AI artifact ↓ HTTPS **Anomity Cloud** classify · evaluate · store ↓ **Security Team** full visibility & control **AI Agent** issues a tool call ↓ **Anomity Hook** policy evaluated · PreToolUse · before it runs ↓ **Allow or Deny** compliant calls run · violations blocked ↓ **Audit Trail** every decision · 90 days 07 § 07 / Why now ## Where Anomity fits alongside what you already run. Anomity covers a category your existing stack was not designed for. It complements what you have, it does not replace it. Tool class What it sees What Anomity covers that it misses AI runtime Agent ↔ tool calls Nothing. No existing control sits where an AI agent invokes a tool. A policy control point *at the agent hook*. On agents that expose a hook, Anomity allows, denies, or logs each tool call *before it runs*. Network layer Gateway / Firewall / Proxy Traffic between agents and LLM providers on the wire. The local side: MCPs, permissions, extensions, plugins, skills, hooks, and secrets on the machine. *Anomity covers the endpoint.* EDR / XDR Processes, binaries, and syscalls on the endpoint. MCP server configuration, agent permission grants, plugin and extension inventory. An MCP server is a legitimate process doing exactly what its config allows. DLP File transfers and content leaving the endpoint. The permission grants and MCP wiring that *enable* the transfer, and the credential typed by hand into a chat window, which never becomes a file at all. CASB / SSPM Sanctioned SaaS and its configuration posture. Which of those grants belong to AI vendors, what data tier each scope exposes, who authorised it, and the same person's local agents and pasted secrets. GRC / manual audit Point-in-time snapshots captured by hand, quarterly at best. Live fleet state, continuous enforcement, real-time change detection, a queryable audit trail, and an AI bill of materials on demand. ” Voices from security teams ## Built with the people who own the blind spot . What early design partners say once they can finally see the AI layer. > The first scan surfaced three MCP servers wired to production data that nobody had approved. We had been flying blind and did not know it. VS **VP Security** Series B fintech > Our spreadsheet of AI tools was out of date the day we made it. Anomity turned it into one live screen the whole team actually trusts. SE **Security Engineer** Healthcare SaaS > Denying a dangerous tool call at the hook, without sandboxing the developer, is the thing every other control promised and never delivered. CI **CISO** Enterprise platform § 08 / Next step ## Govern your AI posture in minutes . A 30-minute walkthrough, tailored to your environment. Full Name Work Email Company Phone Your Role CISO / VP Security Security Engineer IT Admin DevOps / Platform Engineering Lead Other Get a demo Ask AI about Anomity ## Structured data ```json { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://anomity.ai/#organization", "name": "Anomity", "alternateName": [ "Anomity Security", "Anomity AI", "anomity.ai" ], "legalName": "Anomity AI by Deskfirst, Inc.", "url": "https://anomity.ai/", "logo": "https://anomity.ai/icon-512.png", "description": "Agentic AI security. Anomity discovers and governs AI everywhere it runs - agents and MCPs on managed endpoints, AI services and accounts used in the browser, and AI applications holding OAuth grants on your cloud tenant - and enforces policy on agent tool calls in real time.", "sameAs": [ "https://www.linkedin.com/company/anomity", "https://github.com/Anomity-ai", "https://www.wikidata.org/wiki/Q140763940" ] }, { "@type": "WebSite", "@id": "https://anomity.ai/#website", "url": "https://anomity.ai/", "name": "Anomity", "alternateName": [ "Anomity Security", "anomity.ai" ], "publisher": { "@id": "https://anomity.ai/#organization" } }, { "@type": "SoftwareApplication", "@id": "https://anomity.ai/#software", "name": "Anomity", "url": "https://anomity.ai/", "applicationCategory": "SecurityApplication", "operatingSystem": "Windows, macOS, Linux", "description": "Agentic AI security platform. Three collectors feed one console: an unprivileged Endpoint Sensor that discovers every AI agent, MCP server, extension, plugin, skill, secret, hook, CLI, and local model on a managed fleet; a managed Browser Sensor that covers AI web services, the accounts signed into them, and the secrets pasted or uploaded to them; and read-only cloud connectors that find AI applications holding OAuth grants on your tenant. Policy is enforced on agent tool calls in real time - allowing, denying, and logging each call before it runs - with a queryable 90-day audit trail.", "publisher": { "@id": "https://anomity.ai/#organization" }, "offers": { "@type": "Offer", "availability": "https://schema.org/PreOrder", "description": "Book a 30-minute demo." }, "featureList": [ "Fleet-wide discovery of AI agents, MCP servers, extensions, plugins, skills, secrets, hooks, CLIs, and local LLM runtimes", "Browser Sensor for AI web services, personal versus corporate account detection, pasted and typed secret detection, and file upload control", "Cloud AI discovery of third-party applications holding OAuth grants on Google Workspace and GitHub, with scope risk scoring and revocation", "Runtime policy enforcement at the agent hook (allow, deny, log per tool call)", "Detection of AI agent sessions running unattended, and of agents modifying their own configuration mid-session", "Skill and instruction-file content scanning, performed on the device", "Compliance readiness mapping to SOC 2, ISO/IEC 42001, ISO/IEC 42005, the NIST AI RMF, the EU AI Act, and the OWASP Top 10 for LLM Applications", "CycloneDX AI bill of materials export", "Real-time change detection on every endpoint", "Queryable 90-day audit trail", "Decision routing to SIEM, Slack, email, and Jira" ] } ] } ```