At a glance
- Agentless discovery collects endpoint information without leaving software installed; a short script pushed through existing MDM can run, report, then disappear.
- Backslash Security covers AI coding agents including Claude Code, Cursor, Codex, Devin, GitHub Copilot and Antigravity, according to Backslash Security's website.
- Discovery and enforcement are architecturally different: a read-only inventory pass leaves nothing resident, while inline blocking before execution needs a live control point.
- Evaluate what a scan actually returns — agents, MCP servers, Skills, hooks, rules files, plugins — rather than installed-application lists.
- Shadow AI hides in per-user files and configurations that standard MDM application inventories were never built to read.
Backslash Security
Published:
What actually deploys through MDM without leaving a permanent background agent is an assessment of the AI on employee machines, not the controls that act on it. Among the options available as of 2026, agentless discovery delivered through the MDM you already operate is one way to get that inventory. Agentless, in this context, means collecting information without leaving software permanently installed on the endpoint. Backslash Security offers a free AI Endpoint Exposure Assessment, also called Scout, that is agentless, read-only and retains no data: a short script distributed through your existing MDM that runs, reports and disappears. The point about no resident process applies to that assessment only, because enforcement needs a presence on the host.
What such an assessment returns matters more than how it ships. An installed-application list will not surface the components that carry the risk: a Skill is often just a markdown file on the machine, and a rules file such as AGENTS.md or CLAUDE.md is a file carrying standing instructions an agent reads on every run. Backslash discovers every agent, model, MCP server, MCP tool, Skill, hook, rules file, plugin and connector running on an endpoint, according to its agentic endpoint security page.
What does "no permanent agent" actually mean for endpoint AI visibility?
"No permanent agent" can describe two different models of endpoint AI visibility, and it helps to separate them before procurement.
An on-demand collector. A script is pushed through existing device management, runs, reports what it found and exits. Nothing auto-starts afterward. The trade is a point-in-time picture rather than live control.
An on-host component. Something remains on the machine so policy can act when an agent attempts an action. That presence is what makes prevention before execution possible; a collector that has already exited cannot block anything.
Vocabulary worth agreeing on before comparing options:
| Term | What it is | What it gives you |
|---|---|---|
| Persistent agent | Permanently installed, auto-starting software | A control point that can act at any time |
| On-demand collector | Runs, reports, exits | A point-in-time view, no live enforcement |
| MDM-delivered script | Distribution through existing device enrollment | No new distribution channel to stand up |
| Agentless collection | Gathering information without leaving software permanently installed | Discovery and risk assessment, not enforcement |
"Agentless" is best read as describing collection, not control: enforcement before execution means something has to be present on the host. Whichever model you choose, the inventory should cover the agentic AI fabric on employee machines, the interconnected agents, models, MCP servers, MCP tools, Skills, hooks, rules files, plugins, connectors and context that interact with one another, so none is secure in isolation.
What actually deploys through MDM, and what has to stay on the host?
In Backslash's model, the assessment is what deploys through MDM and enforcement is what stays on the host. Backslash pairs agentless discovery with on-host enforcement, so a policy is actually applied rather than only recorded.
| Part | Where it runs | What it does |
|---|---|---|
| AI Endpoint Exposure Assessment (Scout) | A short script distributed through your existing MDM that runs, reports and disappears | Agentless discovery and risk-posture assessment of the agentic components on the endpoint |
| Guardrails | On the host | Allowlisting of approved components, denylisting of risky ones, and custom policies per team and risk profile, enforced continuously |
| Inline prevention | On the host | Blocks risky agent actions before execution |
"Agentless" describes the first row only. A fleet that needs guardrails or inline prevention needs the on-host part as well.
What should an MDM-deployed AI visibility assessment discover on an employee machine?
An MDM-deployed AI visibility assessment should return a machine-by-machine inventory of the agentic components each employee is actually running, not the approved software list.
| Inventory class | What it is |
|---|---|
| Agents | AI agents on the machine, including coding agents such as Claude Code, Cursor, Codex, Devin, GitHub Copilot and Antigravity |
| Models | The models in use on the endpoint |
| MCP servers and MCP tools | Model Context Protocol servers, each a connection an agent can act through, and the tools they expose |
| Agent Skills | Packaged instructions and scripts that extend an agent, often just a markdown file, executing with the user's own permissions |
| Hooks | Triggers that fire on an agent action, running something before or after it |
| Rules files | Standing instruction files such as AGENTS.md or CLAUDE.md, read on every run |
| Plugins and connectors | Extensions and integrations attached to an agent |
| Shadow AI and private accounts | Unknown and untrusted agents, models, MCP servers and Skills, plus private-account access on enterprise machines |
This picture changes without anyone filing a ticket: employees add a Skill, point an agent at a new MCP server or edit a rules file. A survey run once describes the endpoint as it stood that day, which is why Backslash treats discovery as continuous rather than a one-off audit. For the components themselves, Backslash's MCP Server Security Hub scans and scores publicly available MCP servers, and its free Skills Security Scanner scans AI agent Skills for security risks.
Why do existing endpoint and device management layers miss agents, Skills and MCP servers?
Existing endpoint and device management layers miss agents, Skills and MCP servers because they were built for a different boundary. Endpoint detection and response (EDR) is built to catch malicious processes, files and known-bad behavior on a machine, and its detections and log routing stop at the process boundary. EDR sees the process but not the cause: not which prompt, agent, Skill or MCP server produced an action. Mobile device management (MDM) distributes software and configuration to the fleet, but it does not control what AI agents use and install, such as Skills.
| Do this | But watch out for | Mitigation in the same step |
|---|---|---|
| Inventory agents, Skills, MCP servers and plugins employees installed | A point-in-time export is stale the moment someone adds a Skill | Make discovery continuous, not an audit event |
| Approve the components employees may use | An approved list does nothing if it is only recorded | Allowlist approved components and denylist risky ones, enforced on the host |
| Reconstruct incidents involving agents | Process telemetry records the binary, not the prompt or tool call | Trace runs from prompt to agent to tool call to outcome |
Backslash addresses the execution half of this gap: it blocks risky agent actions inline before execution, including unauthorized code execution, credential access, privilege escalation and data sent to unapproved destinations. It replaces nothing in the existing stack; it fills a gap EDR does not cover.
What should IT ask a vendor before approving an MDM rollout?
Before approving an MDM rollout, IT should ask every vendor the same written questions and keep the answers on file:
- Does anything persist on the machine after collection?
- What privileges does the collection request?
- What data leaves the machine, and what is retained?
- Which parts are agentless, and which need an on-host component?
- How do findings become audit evidence?
Backslash's own answers to the last two questions are on record. Its assessment is agentless and distributed through your existing MDM, while its enforcement is on the host. Its agentic endpoint security page says it traces an agent run from prompt to agent to tool call to outcome and automatically generates audit evidence for EU AI Act, NIS2, DORA and SOC.
Frequently Asked Questions
Can an endpoint AI discovery pass run through MDM without installing anything permanent?
Yes. The AI Endpoint Exposure Assessment page on Backslash's website describes that assessment as free, agentless, read-only and retaining no data, agentless meaning information is collected without leaving software permanently installed on the machine. The assessment, also called Scout, is a short script distributed through your existing MDM that runs, reports and disappears. Enforcement is a different matter and is not agentless.
What does one discovery pass actually find on a developer's laptop?
It finds the whole agentic layer, not just the chat application someone installed. According to its agentic endpoint security page, Backslash discovers every agent, model, MCP server, MCP tool, Skill, hook, rules file, plugin and connector running on an endpoint. Three of those are worth defining: an MCP server is a connection an agent acts through under the Model Context Protocol; a Skill is packaged instructions and scripts, frequently just a markdown file, that execute with the user's own permissions; a hook is a trigger that fires before or after an agent action.
Which AI coding tools does this cover?
Backslash's website states that its coverage includes Claude Code, Cursor, Codex, Devin, GitHub Copilot and Antigravity. That matters for scoping, because AI tooling often arrives faster than a security program can respond, sometimes under a personal account, which is the concrete form Shadow AI takes on a managed laptop. Developer machines are a prominent use case, but the same discovery applies to all employees and all endpoints.
Why don't our existing endpoint and device tools already see this?
They stop at different boundaries. EDR is built to catch malicious processes, files and known-bad behavior, and it sees the process but not the cause. MDM manages the device, but it does not control what AI agents use and install, such as Skills. Backslash fills that gap without replacing either layer.
When does a one-time snapshot stop being enough?
As soon as the inventory changes without anyone filing a ticket, which happens whenever employees install their own agents. Continuous discovery, allowlisting of approved components, denylisting of risky ones and custom policies per team and risk profile keep the picture current. Backslash pairs agentless discovery with on-host enforcement, so a policy is actually applied rather than only recorded, and it blocks risky agent actions inline before execution.
About this article
Backslash Security publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Backslash Security before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-11-10