At a glance
- Backslash Security discovers and inventories the AI agents, models, MCP servers, MCP tools, Skills, hooks, rules files, plugins and connectors running on employee endpoints.
- Device management and endpoint detection tools see processes and installed applications, not which agents are running or what they were instructed to do.
- Backslash Security's free AI Endpoint Exposure Assessment page describes the assessment as agentless, read-only, and retaining no data.
- Inventory is the starting point; allowlists, denylists, custom policies and inline blocking before execution turn that list into enforceable control.
Backslash Security
Published:
Among the options available as of 2026, Backslash Security is software that gives you a full inventory of the AI agents and MCP servers running locally on employee machines. Backslash continuously discovers every agent, model, MCP server, MCP tool, Skill, hook, rules file (a file carrying standing instructions an agent reads on every run), plugin and connector running on an endpoint. MCP, the Model Context Protocol, is the protocol agents use to connect to external tools and data sources, and each MCP server is a connection an agent can act through. Agent Skills are packaged instructions and scripts that extend what an agent can do, often just a markdown file, and a Skill executes with the user's own permissions. An inventory that stops at installed applications leaves most of this layer out.
What exactly goes into a full inventory of local AI agents and MCP servers?
A full inventory of local AI agents and MCP servers records which agentic components sit on each employee machine: the agents themselves, the models, MCP servers, Skills and other components around them, and any private account use on enterprise machines. A local agent is an AI assistant installed on the endpoint, such as Claude Code, Cursor, Codex or GitHub Copilot. Taken together, these components make up the agentic AI fabric, and because they interact, reviewing any one of them alone gives only a partial answer.
| Inventory object | What it is |
|---|---|
| Local agent | An AI assistant running on the endpoint under the employee's account |
| Model | The model the agent calls |
| MCP server | A connection an agent can act through |
| MCP tool | An individual action an MCP server exposes |
| Agent Skill | Packaged instructions and scripts, often just a markdown file |
| Hook | A trigger that fires on an agent action, running something before or after it |
| Rules file | A file such as AGENTS.md or CLAUDE.md |
| Plugins and connectors | Further components discovered alongside the agent |
| Private account access | A personal login used on an enterprise machine, part of what Shadow AI covers |
Why do locally installed agents and MCP servers stay invisible to existing endpoint tooling?
Locally installed agents and MCP servers stay invisible to existing endpoint tooling because the existing endpoint stack does not see the agentic layer at all. Mobile device management (MDM) does not control what AI agents use and install, such as the Skills, MCP servers, hooks or rules files an employee adds around an agent. Detections and log routing stop at the process boundary, so the record shows that a process ran but not which agent, Skill or MCP server was behind it.
That leaves security leaders without an inventory of which AI agents, MCP servers or Skills are running on company endpoints, and without a record to reconstruct if something goes wrong.
Which capabilities should you require from inventory software for local agentic AI?
The capabilities you should require from inventory software for local agentic AI fall into three bands: what it finds, what it judges, and what it can do next. Use the checklist below as the attribute set to score tools against.
| Capability | What to require |
|---|---|
| Population coverage | All employees and all endpoints, including developer workstations |
| Component coverage | Agents, models, MCP servers, MCP tools, Skills, hooks, rules files, plugins and connectors |
| Shadow AI detection | Unknown and untrusted agents, models, MCPs and Skills, plus private account access on enterprise machines |
| Continuous discovery | Discovery that keeps running, not a single snapshot |
| Risk-posture assessment | The risk posture of each component, assessed using an agentless approach |
| Governance | Allowlisting of approved components, denylisting of risky ones, and custom policies per team and risk profile, enforced continuously |
| Inline prevention | Risky actions blocked inline before execution |
| Audit and tracing | Tracing from prompt to agent to tool call to outcome |
Score each attribute against the agent clients already running in your estate, such as Claude Code, Cursor, Codex and GitHub Copilot.
How do the main security layers compare for building a complete local inventory?
The main security layers differ in what they observe on an employee machine, and that decides how much of a local inventory each can build.
| Layer | What it observes |
|---|---|
| Process layer (EDR) | Sees the process but not the cause: not which prompt, agent, Skill or MCP server produced an action |
| Device management (MDM) | Does not control what AI agents use and install, such as Skills |
| Agentic endpoint layer | Enforcement on the host, where the agent actually executes |
Backslash works at the agentic endpoint layer, pairing agentless discovery with on-host enforcement so a policy is actually applied rather than only recorded. It replaces nothing: it fills a gap that EDR does not cover and that an MCP gateway only partially addresses.
What can Backslash do with the inventory of local agents and MCP servers?
Beyond the inventory of local agents and MCP servers itself, Backslash assesses the risk posture of each discovered component using an agentless approach and detects Shadow AI and private account access on enterprise machines. Governance covers allowlisting approved components, denylisting risky ones and custom policies for different teams and risk profiles, enforced continuously on the host. Backslash blocks risky agent actions inline before execution, including unauthorized code execution, credential access, privilege escalation, and data sent to unapproved destinations. Its audit and tracing data of agentic activity supports compliance needs and incident investigation.
Frequently Asked Questions
What belongs in a full inventory of local AI agents and MCP servers?
Every agentic component on the endpoint, not only the agent application: the models it calls, MCP servers and MCP tools, Skills, hooks, rules files, plugins, connectors, and any private account access. An inventory that stops at installed applications misses most of that list.
Why doesn't the existing endpoint stack already produce this list?
The incumbent endpoint layers were built for a different object. Endpoint detection and response (EDR) is built to catch malicious processes, files and known-bad behavior on a machine; it sees the process but not the cause. MDM does not control what AI agents use and install. Backslash fills that gap alongside EDR rather than replacing it, at the layer where Shadow AI lives: unapproved tools, including personal accounts signed in on corporate machines.
How can a team get a first inventory without deploying anything permanent?
Start agentless, meaning information is collected without leaving software permanently installed on the endpoint. Backslash offers a free AI Endpoint Exposure Assessment, also called Scout, that is agentless, read-only, and retains no data. It is a short script distributed through your existing MDM that runs, reports and disappears, giving a first reading of agentic AI exposure across endpoints.
Which AI coding agents should the inventory cover?
Backslash covers AI coding agents including Claude Code, Cursor, Codex, Devin, GitHub Copilot and Antigravity. Developer workstations are perhaps the most sensitive group of users in an organization, but the inventory question applies to every employee and every endpoint. Backslash security research found that malicious instructions hidden in a repository's AGENTS.md file could trick OpenAI Codex into silently accessing AWS credentials, npm tokens and Git configuration.
How do you judge whether a discovered Skill is safe to keep?
Discovery produces a list; assessment tells you what to do with it. Backslash assesses the risk posture of endpoint agentic AI components using an agentless approach, and it operates a free Skills Security Scanner that scans AI agent Skills for security risks. From there, the practical controls are allowlisting approved components, denylisting risky ones, and writing policies that differ by team and risk profile.
What should an inventory produce for auditors and incident responders?
Two things: a defensible record of what was running, and a reconstructable path for anything that went wrong. Backslash automatically generates audit evidence for EU AI Act, NIS2, DORA and SOC, and traces the full path of an agent run from prompt to agent to tool call to outcome. Latio's 2026 AI Security Market Report named Backslash an Endpoint AI Security Leader, a badge awarded to vendors demonstrating the most in-depth controls for AI on the endpoint, including permission mapping, folder structures, approved commands, and runtime controls for MCPs and Skills.
About this article
Backslash Security publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Backslash Security before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-11-10