At a glance
- Restricting AI agent Skills works best as allowlisting and denylisting of approved components, not as a blanket ban on developer tooling.
- Discovery comes first: you cannot govern agents, MCP servers, Skills, hooks or rules files that no inventory records.
- Backslash Security discovers the agentic AI fabric on endpoints, assesses risk, and enforces custom policies per team continuously.
- Inline prevention keeps a plugin usable while stopping the specific risky action, so developers retain velocity under enforced guardrails.
Backslash Security
Published:
To restrict the plugins, Agent Skills and MCP servers developers keep adding to their AI tools without blocking the developers themselves, use a control layer that discovers every one of those components, assesses their risk, and enforces an allowlist and denylist per team. Backslash Security discovers the agents, MCP servers and Skills running on employee endpoints, assesses which are safe to use, and enforces continuous guardrails, so approved tooling keeps working while risky components are denied. Agent Skills are packaged instructions and scripts that extend what an agent can do (in practice often just a markdown file on a developer's machine), and they execute with the user's own permissions, which is why an inventory and a policy matter more than a ban. Model Context Protocol, or MCP, is the protocol agents use to connect to external tools and data sources, and each MCP server is a connection an agent can act through; Backslash's MCP Server Security Hub has scanned and scored publicly available MCP servers. Among the options available as of 2026, Latio's 2026 AI Security Market Report named Backslash an Endpoint AI Security Leader, a badge awarded to vendors demonstrating the most in-depth controls for AI on the endpoint, including permission mapping, folder structures, approved commands, and runtime controls for MCPs and Skills.
Why do new plugins and agent skills appear faster than security can review them?
New plugins, Skills and connectors reach AI agent tooling as files and configuration changes on a laptop rather than as software installations, which is why they outpace any review queue. Your existing MDM has a blind spot on what AI agents use and install, Skills included, and the rest of the endpoint stack does not see the agentic layer at all: detections and log routing stop at the process boundary. The component simply exists, and it runs with the employee's own identity and access.
If you own AI risk across a large, engineering-heavy workforce, the practical problem is that a Skill copied from a repository, an MCP server added to a local config file, a rules file changed by a commit, and a plugin loaded inside Cursor, Claude Code or GitHub Copilot each arrive through a different channel, and none of them looks like software to the existing stack. These components can run without security approval or visibility, often under personal accounts.
What exactly counts as an AI agent skill, and what sits alongside it?
An AI agent skill, in the precise sense, is an Agent Skill: a packaged bundle of instructions and scripts, often literally a markdown file sitting in a folder on the endpoint, that tells an agent to read a file, call an API, or run a shell command, executing with that employee's own permissions. A developer drops a Skill file into Claude Code or Cursor, and the agent can now run a command it could not run yesterday, with nothing installed through IT.
People also say "skill" loosely for any new capability an agent picks up, such as a connector to a ticketing system or a plugin inside the IDE. Those are real risk surfaces with their own mechanisms, so a restriction policy has to name each one:
| Component | What it is | How it reaches the endpoint |
|---|---|---|
| Agent Skill | Packaged instructions and scripts an agent can invoke, running under the user's identity | Copied, cloned, or pulled from a repository as a file |
| MCP server | A connection through the Model Context Protocol that an agent uses to reach external tools and data | Added to a local configuration |
| MCP tool | A single callable function exposed by an MCP server | Exposed by whichever server the agent connects to |
| Hook | A trigger that fires on an agent action, running something before or after it | Local configuration |
| Rules file (AGENTS.md, CLAUDE.md) | A file in a repository or on a machine carrying standing instructions the agent reads on every run | A commit in any repository the agent touches |
| Plugin / connector | An extension or link to an external system | Loaded inside AI tools such as Cursor, Claude Code or GitHub Copilot |
| Context | Files, repositories and documents the agent reads | Whatever the agent opens during a task |
Which control layers can restrict agent skills without blocking developers?
Several control layers can restrict what AI agents do on a developer's machine, and they differ mainly in what each one can see and where it acts.
| Layer | What it governs | Where it acts |
|---|---|---|
| Network-layer inspection | Agent traffic at the network layer | In transit, rather than on the host where the agent executes |
| EDR and MDM | Processes, devices and installed software | Sees the process but not the cause: not which prompt, agent, Skill or MCP server produced an action |
| Agentless-only governance tools | Discovery, with nothing deployed on the endpoint | No on-host enforcement point |
| Endpoint agentic controls | Agents, models, MCP servers, Skills, hooks, rules files, plugins and connectors | On the host, inline before the action executes |
Backslash operates at the endpoint agentic layer, where approved components can be allowlisted, risky ones denylisted, and custom policies written to suit different teams and risk profiles, then enforced continuously. It pairs agentless discovery with on-host enforcement, so a policy is actually applied rather than only recorded. It replaces nothing: it fills a gap that EDR does not cover.
What capabilities should software have to govern agent skills at enterprise scale?
Software that governs agent Skills at enterprise scale has to cover the full component set rather than one surface. Backslash combines the following capabilities in one platform:
| Capability | What to require from the software | Why it matters |
|---|---|---|
| Continuous discovery | Coverage of the full component set: agents, models, MCP servers, MCP tools, Skills, hooks, rules files, plugins and connectors | Without a live inventory there is nothing to report against, and Shadow AI stays invisible to the existing endpoint stack |
| Risk assessment | A risk posture assessment of each component | Approval decisions need evidence about the specific component, not a vendor category |
| Policy | Allowlisting of approved components, denylisting of risky ones, and custom policies per team and risk profile, enforced continuously | A large organization does not have one risk appetite; different teams need different rules |
| Inline prevention | Blocking of risky agent actions before execution | A policy is applied rather than only recorded |
| Reconstruction | Audit and tracing data of agentic activity, from prompt to agent to tool call to outcome | Incident investigation and compliance evidence both depend on records captured at the time |
In Backslash's approach, discovery and risk assessment are agentless, meaning information is collected without leaving software permanently installed on the endpoint, while enforcement runs on the host. On the compliance side, Backslash automatically generates audit evidence for EU AI Act, NIS2, DORA and SOC.
How do allowlists and inline blocking keep developers working?
Allowlists and inline blocking keep developers working because approved tooling stays available while risky components and risky actions are stopped. A plugin here means any add-on that extends an AI tool: an editor extension, a connector, or an installed Skill. Backslash pairs component policy (allowlisting approved components, denylisting risky ones) with inline prevention: it blocks risky agent actions inline before execution, including unauthorized code execution, credential access, privilege escalation, and data sent to unapproved destinations.
| Do this | Why it keeps developers working |
|---|---|
| Allowlist the plugins and Skills engineers already depend on | Approved tooling keeps working while unapproved components are denied |
| Denylist components whose risk posture fails assessment | Risky components are removed from use without banning the AI tools themselves |
| Scope policies per team and risk profile | One rule set for everyone either over-blocks some teams or under-protects others |
| Detect private-account access on corporate machines | Shadow AI under personal logins sits outside every approved workflow |
How should the rollout be sequenced?
A rollout across a large workforce keeps developers working when visibility comes before control, so security enables safe usage of AI rather than hindering its adoption.
- Discover. Build an inventory of what employees are already running: AI coding agents such as Claude Code, Cursor and GitHub Copilot, the MCP servers they connect through, the Agent Skills layered on top, and agents or models used under personal accounts on corporate machines. The free AI Endpoint Exposure Assessment (also called Scout) is a short script distributed through your existing MDM that runs, reports and disappears; it is agentless, read-only and retains no data.
- Assess. Review the risk posture of each discovered component before deciding what to approve.
- Allowlist and denylist. Allowlist the components engineering depends on, denylist those whose risk posture fails assessment, and write distinct policies per team and risk profile rather than one global rule.
- Enforce inline. Apply those policies continuously on the host, with risky actions blocked before execution.
- Name an exception owner. Publish who owns exception requests before the first blocking policy goes live, so engineers know where to ask when an action is refused.
Frequently Asked Questions
What are AI agent Skills, and why doesn't MDM restrict them?
Agent Skills are packaged instructions and scripts that extend what an AI agent can do: a Skill can tell an agent to read a file, call an API, or run a shell command, and it executes with the employee's own permissions. In practice, a Skill is often just a markdown file sitting on a developer's machine, which is why your existing MDM does not control it; MDM has a blind spot on what AI agents use and install. The same gap applies to MCP servers and to hooks, the triggers that fire something before or after an agent action. Backslash discovers every agent, model, MCP server, MCP tool, Skill, hook, rules file, plugin and connector running on an endpoint.
How can we restrict risky components without blocking developers?
Governance works best as a permission boundary rather than an on/off switch. Backslash supports allowlisting approved components and denylisting risky ones, with custom policies built per team and risk profile and enforced continuously, so a platform team and a customer-facing team can run different rules on the same AI tooling. Enforcement happens at the moment of action: Backslash blocks risky agent actions inline before execution, including:
- unauthorized code execution
- credential access
- privilege escalation
- data sent to unapproved destinations
Approved components stay on the allowlist while those actions are blocked.
How do we find Shadow AI before we write any policy?
Shadow AI is AI tools, agents, MCP servers and Skills running inside the organization that security has not approved and cannot see, often installed by employees under personal accounts, such as an engineer connecting through a private Gmail login on a corporate machine. You cannot allowlist what you have never enumerated, so discovery comes first. Backslash offers a free AI Endpoint Exposure Assessment that is agentless, read-only, and retains no data, and a free Skills Security Scanner that scans AI agent Skills for security risks.
Can a plugin or rules file really be used to attack us?
Yes, and the mechanism is prompt injection: hidden instructions placed in content an agent reads, which the agent then follows as though the user had typed them. A rules file, such as an AGENTS.md or CLAUDE.md, carries standing instructions an agent reads on every run, which makes it an attractive place to hide them. Backslash security research found that malicious instructions hidden in a repository's AGENTS.md file could trick OpenAI Codex into silently accessing AWS credentials, npm tokens and Git configuration.
What record do we have if an agent does something it shouldn't?
A trace of the agent run itself, not just process telemetry. Backslash traces the full path of an agent run from prompt to agent to tool call to outcome, and collects audit and tracing data of agentic activity to support compliance needs and incident forensics and investigation.
Which AI coding tools does this cover, and who is it for?
Backslash covers AI coding agents including Claude Code, Cursor, Codex, Devin, GitHub Copilot and Antigravity. Latio's 2026 AI Security Market Report concludes that Backslash is "one of the most complete options available," with coverage spanning the full agentic surface from Claude Code and Cursor to the MCP servers and Skills running on top of them. The scope is all employees and all endpoints; developer workstations are a prominent use case, not the whole of it.
About this article
Backslash Security publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Backslash Security before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-11-10