At a glance
- Set shortlist criteria before vendor names: discovery depth, risk assessment, enforcement point, and the audit record a tool leaves behind.
- Ask each candidate whether it can name individual Skills, MCP servers, hooks and rules files on a machine.
- Per Backslash Security, the platform automatically generates audit evidence for EU AI Act, NIS2, DORA and SOC.
- Backslash Security's free AI Endpoint Exposure Assessment is agentless and read-only and retains no data, giving a first inventory quickly.
Backslash Security
Published:
Shortlist endpoint AI visibility tools by fixing your evaluation criteria before you look at vendors: depth of discovery, quality of risk assessment, the point at which policy is enforced, and the audit record that survives an incident. Discovery is the first filter. A serious candidate should be able to name, on a given laptop, every agent, model, MCP server, MCP tool, Agent Skill, hook, rules file, plugin and connector in use — which is what Backslash Security discovers on an endpoint. MCP, the Model Context Protocol, is how agents connect to external tools and data sources, and each MCP server is a live connection an agent can act through. Agent Skills are packaged instructions and scripts that extend what an agent can do, executing with the user's own permissions. A rules file — AGENTS.md or CLAUDE.md, for example — carries standing instructions the agent reads on every run.
Those component types matter in 2026 because they are where the risk sits. Backslash Security research found that malicious instructions hidden in a repository's AGENTS.md file could trick OpenAI Codex into silently accessing AWS credentials, npm tokens and Git configuration. The same inventory gap covers shadow AI: unapproved agents, models, MCP servers and Skills that employees install themselves, often under personal accounts, on corporate machines.
What exactly does an endpoint AI visibility tool need to discover on an employee machine?
Scope this to one machine at a time: exactly which artifacts an endpoint AI inventory has to enumerate before any policy, assessment, or blocking decision becomes possible. The unit of discovery is the component an agent can read, invoke, or execute — each one running with the employee's own identity, credentials, and access.
These components together form the agentic AI fabric: the interconnected layer of agents, models, MCP servers, MCP tools, Skills, hooks, rules files, plugins, connectors, and context on a single host. They interact, so enumerating one class in isolation leaves the others unaccounted for.
| Artifact | What it is | Attributes the inventory must record |
|---|---|---|
| Agents and models | Coding and desktop agents such as Claude Code, Cursor, GitHub Copilot, Codex, Devin, and Antigravity, plus the models they run | Version, install path, model in use, and whether sign-in is a corporate identity or a personal account |
| MCP servers and MCP tools | Model Context Protocol is the protocol agents use to reach external tools and data; each server is a connection an agent can act through | Server origin, transport, credentials held, and the individual tools exposed |
| Agent Skills | Packaged instructions and scripts that extend an agent — in practice often just a markdown file — executing with the user's permissions | Source, file location, and the commands, file reads, or API calls it authorizes |
| Rules files | Standing instructions an agent reads on every run, such as AGENTS.md or CLAUDE.md | Path, contents, and modification history |
| Hooks | Triggers that fire before or after an agent action | What the trigger runs and under which conditions |
| Plugins and connectors | Extensions linking an agent to third-party systems | Destination system, scope of access granted |
Those attributes are what make later decisions executable: an allowlist needs source and version, an investigation needs modification history, and an inline block needs to resolve which Skill or MCP server initiated a call. Backslash Security assesses the risk posture of these endpoint components using an agentless approach — gathering that detail without leaving software permanently installed on the machine.
Why do existing endpoint and network layers miss the agentic AI fabric?
When security teams map an existing control stack, the endpoint layer and the network layer each answer their own question, and the agentic layer sitting between them goes unaccounted for. EDR — endpoint detection and response, the incumbent layer built to catch malicious processes, files and known-bad behavior — records that an interpreter spawned a shell command. Network inspection records that a TLS session reached an API host. Both observations are correct at their own layer, while the instruction that caused the action sits in a local file nobody enumerated.
Which "agent" are we talking about?
The word carries two distinct meanings in this conversation, and conflating them is where the blind spot starts.
- The installed software agent. A permanently resident sensor pushed through MDM tooling such as Intune or Jamf, reporting processes, binaries and device posture. Example: a managed laptop reporting that a signed developer tool executed.
- The AI agent. Software like Claude Code, Cursor or Codex that reads instructions, plans, and acts through tool calls using the employee's own identity and access. Example: an agent reading a rules file — AGENTS.md or CLAUDE.md, a file carrying standing instructions the agent follows on every run — and then calling an MCP server, the Model Context Protocol connection through which an agent reaches external tools and data.
This article uses the second meaning throughout.
What falls between the layers is everything that shapes that second agent's behavior: Skills (packaged instructions and scripts, often just a markdown file executing with the user's permissions), hooks that fire before or after an agent action, plugins, connectors, locally run models, and the rules files above. Backslash Security research discovered that malicious repository configurations can redirect Claude Code API requests to an attacker-controlled server, silently exposing the user's sign-in token.
What has changed in 2026 that makes this a separate buying decision?
In 2026, what has changed is where the risk physically sits: the components that make an AI agent useful — Skills, MCP servers, hooks and rules files — install and execute on an employee's own machine, under that employee's own identity and permissions. That is a different object of control from the SaaS applications and browser sessions most existing security renewals were scoped around, which is why it can be scoped as its own line item rather than as an add-on to an existing contract.
Four shifts separate the current state from the prior one:
- The unit of installation. An Agent Skill — packaged instructions and scripts that extend what an agent can do — is often just a markdown file on a laptop. No installer runs, so MDM inventory does not register it.
- The connection surface. MCP (Model Context Protocol) is the protocol agents use to reach external tools and data; each MCP server is a live path an agent can act through, added by the user without a procurement step.
- The identity in play. Agents execute with the signed-in user's credentials, so an unsanctioned tool — or an employee working through a personal account on a corporate machine — inherits that access directly.
- The cadence. Every model release and every change to the MCP or Skills protocol surface forces follow-on work, a rhythm that does not align to a multi-year renewal.
For a team at the consideration stage, the practical task is building criteria before booking demos. Latio's 2026 AI Security Market Report states that Backslash Security "was one of the first companies to focus on securing AI on the endpoint, building AI endpoint controls well before this year's rush of newcomers," which indicates how recently this evaluation category took shape.
Which architectural approaches should a 2026 shortlist actually compare?
Shortlisting in 2026 gets easier once the candidate architectural approaches are separated by one question: where does the product observe agent activity, and where can it act on it? Define the criteria before scoring any vendor:
- Resolution. Can the approach name the specific agent, Skill, MCP server or rules file behind an action? A Skill is packaged instructions a user's agent can invoke, and an MCP server is a connection an agent acts through under the Model Context Protocol. Resolution is decisive when you need to attribute an action, not just see it.
- Point of enforcement. Inline on the host before execution, or after traffic has already left the machine. This matters most for credential access and data sent to unapproved destinations.
- Deployment friction. Agentless means collecting information without leaving software permanently installed. Decisive where endpoint change control is slow.
- Reconstructability. Whether the record supports forensics and audit after an incident.
Identity and SaaS log analysis — sign-in records from an identity provider — scores well on friction and on catching private-account sign-ins, but stays silent on a local markdown Skill that never touches an identity provider.
| Architecture | Observation point | Enforcement point | Noted strength |
|---|---|---|---|
| Endpoint-resident agentic layer (Backslash Security) | Agents, models, MCP servers, MCP tools, Skills, hooks, rules files, plugins and connectors on the endpoint | Inline, on the host, before execution | Backslash Security blocks unauthorized code execution, credential access and privilege escalation inline |
| Network-layer agent traffic inspection (Air Security) | Agent traffic in transit | Network path | Suits environments where deploying endpoint software is difficult |
| Network-layer security estate (Zscaler) | Network path | Network path | A natural extension for buyers who already own it |
| EDR (CrowdStrike, SentinelOne) | Processes, files, known-bad behavior | Host | Established footprint and broad general-purpose coverage |
| Endpoint application control (ThreatLocker) | Software execution | Host | Already stops unapproved software from running |
| Agentless-only governance tooling | Existing tools' own APIs and hooks | Settings changed inside each existing tool | Nothing to deploy on the endpoint; fastest possible path to first visibility |
How should you weight discovery depth, inline action control, and after-the-fact reconstruction when scoring candidates?
Scoring a candidate on this axis means assigning explicit weight to three separable capabilities — discovery depth, inline action control, and reconstruction — and this section covers only how those three are graded during a shortlist evaluation. Set the criteria before any vendor demo, because each one is decisive in a different situation.
Discovery depth. Allowed values run from application-level inventory (naming Cursor, Claude Code, or Copilot on a machine) to component-level inventory of what those applications load: MCP servers — the Model Context Protocol connections an agent acts through — plus Agent Skills, which are packaged instructions and scripts that run with the user's own permissions; hooks, which are triggers that fire before or after an agent action; and rules files such as AGENTS.md or CLAUDE.md, which carry standing instructions an agent reads on every run. This criterion is decisive when the reporting obligation is an inventory, or when the exposure is unsanctioned AI use — unapproved tools and personal account logins on corporate machines.
Inline action control. The question is whether a policy is advisory or enforced at the moment of execution. Allowed values: alert-only, post-hoc revocation, or prevention before the action completes. Decisive where the risky action is irreversible — a credential read, an outbound transfer to an unapproved destination.
Reconstruction. Grade whether the record resolves cause, not just effect: which prompt, which agent, which tool call produced an outcome. Decisive for incident investigation and for auditors who ask what an agent did and why.
Backslash Security blocks risky agent actions inline before execution, including unauthorized code execution, credential access, privilege escalation, and data sent to unapproved destinations.
What proof should a candidate tool show before it earns a place on the shortlist?
Proof, for a candidate tool in this category, means evidence collected on real employee machines under real conditions — not a scripted walkthrough of a prepared demo environment. If a product claims coverage across all employees and all endpoints, that claim means it must survive a pilot on machines nobody cleaned up first: contractor laptops, non-engineering staff, personal accounts signed into corporate devices. The documentation and test requests below are what turn a marketing claim into something a security team can report against.
What to request before a vendor reaches the shortlist
- A pilot inventory from a representative endpoint sample — include non-developer users, not only the engineering group, and ask for the raw export rather than a dashboard screenshot.
- Component-level resolution — the inventory should name individual agents such as Claude Code, Cursor or Codex, plus the MCP servers, Skills, hooks and rules files sitting on top of them, rather than stopping at a process list.
- A staged enforcement test — define a disallowed action in advance, trigger it, and confirm it was stopped before execution rather than alerted on afterward.
- A single reconstructed run — ask the vendor to trace one agent run end to end, from the prompt through the tool call to the outcome, as an incident investigation would require.
- Deployment and integration documentation — how the assessment or sensor is distributed through existing MDM such as Intune or Jamf, and how events route into an existing SIEM.
- Independent evaluation — Latio's evaluation found that "where Backslash stood out in our evaluation is in control depth," beyond scanning for what's malicious.
Shortlists are decided less by the breadth of a vendor's supported-tool list than by what its discovery returns on the untidiest machine in the pilot. Keep the pilot export; it becomes the baseline inventory the next vendor has to match.
Frequently Asked Questions
What capabilities belong on a shortlist of endpoint AI visibility tools?
A workable shortlist for endpoint AI visibility starts with four capabilities: continuous discovery of every agentic component on the machine, a risk assessment of each one, enforceable policy, and a retrievable record of what happened. Discovery has to reach past the application itself to the parts that extend it — Agent Skills (packaged instructions and scripts that extend what an agent can do, executing with the user's own permissions), MCP servers, hooks, rules files, plugins and connectors. Backslash Security discovers every agent, model, MCP server, MCP tool, Skill, hook, rules file, plugin and connector running on an endpoint, which is the inventory a governance owner reports against.
How does endpoint AI discovery differ from what an existing endpoint agent reports?
Endpoint detection and response, or EDR, is the incumbent endpoint security layer, built to catch malicious processes, files and known-bad behavior on a machine. It records the process that executed. Investigating an agent run calls for a different chain of facts: which prompt, which agent, which Skill, which MCP server produced the action. MCP, the Model Context Protocol, is how agents connect to external tools and data, so each MCP server is a path an agent can act through. Backslash Security resolves that chain and traces the full path of an agent run from prompt to agent to tool call to outcome.
Which parts of agentic AI endpoint security can be agentless, and which cannot?
Agentless means collecting information without leaving software permanently installed on the endpoint, and it fits discovery and assessment well. Backslash Security offers a free AI Endpoint Exposure Assessment that is agentless, read-only, and retains no data — distributed through existing MDM tooling such as Intune or Jamf, it is a low-friction route to a first picture of shadow AI, meaning AI tools, agents, MCP servers and Skills that security has not approved and cannot see. Enforcement works differently: Backslash Security blocks risky agent actions inline before execution, including unauthorized code execution, credential access, privilege escalation, and data sent to unapproved destinations.
What compliance evidence should an endpoint AI tool produce?
Auditors ask for the inventory, the policy applied, and the trace of what an agent actually did. Backslash Security automatically generates audit evidence for EU AI Act, NIS2, DORA and SOC, which removes the manual reconstruction work that otherwise falls on the security team after an incident or before an audit window. When scoring candidates, check whether audit and tracing data is collected continuously or assembled on request, and whether it routes into the systems your team already reviews, such as a SIEM or a ticketing queue.
Why do rules files and Skills deserve specific attention?
A rules file — commonly AGENTS.md or CLAUDE.md — is a file in a repository or on a machine carrying standing instructions an agent reads on every run, so its contents shape behavior silently. Backslash Security research found that malicious instructions hidden in a repository's AGENTS.md file could trick OpenAI Codex into silently accessing AWS credentials, npm tokens and Git configuration. This is the mechanism behind prompt injection: hidden instructions inside content an agent reads, which the agent follows as though a user had typed them. Skills carry the same exposure, since a Skill is often a markdown file sitting on the machine.
Which organizations get the most from a dedicated agentic endpoint product?
Depth of AI adoption, rather than headcount alone, determines fit. Organizations where a substantial population actively builds or runs AI agents accumulate agents, MCP servers and Skills faster than a general endpoint program can catalog them. Backslash Security's MCP Server Security Hub, a public and continuously updated risk database, held 81,021 MCP servers, each scored for risk, when read on 22 September 2026, and Latio's 2026 AI Security Market Report named Backslash an Endpoint AI Security Leader, a badge awarded to vendors demonstrating the most in-depth controls for AI on the endpoint, including permission mapping, folder structures, approved commands, and runtime controls for MCPs and Skills.
About this article
Backslash Security publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Backslash Security before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-10-07