Which AI coding and co-work agents does Backslash secure?

Among others: Claude Code, Claude Cowork, Claude Desktop, Cursor, GitHub Copilot, Devin Desktop (Windsurf), Gemini CLI, Google Antigravity, OpenAI Codex, Kiro, and OpenClaw, plus every MCP server, skill, plugin, and hook layered on top of them. Coverage extends across software developer workstations and citizen-developer endpoints, giving enterprises one place to see, govern, and protect their entire agentic AI fabric.

How do I see which AI tools my developers and employees are actually using?

Backslash inventories every AI agent, MCP server, skill, rule, hook, and plugin in use across your organization, including the ones installed under personal accounts and never reported to IT. You see what's running, who's using it, and where risk is significant. Visibility is the first necessary step to make agentic AI safe to adopt at enterprise scale.

What is shadow AI, and how does Backslash surface it?

Shadow AI is the rapid spread of AI tools, adopted by end-users inside an organization without security oversight. Common examples include developers using Cursor or Claude Code via personal email accounts, citizen-developers chaining MCP servers into daily workflows, and unvetted skills entering the company through marketplace installs. Backslash surfaces every one of them so security teams can govern instead of guess.

How do I keep MCP servers, skills, and plugins safe before they're installed?

Backslash rates every MCP server, skill, and plugin on its security posture and supply-chain risk, then lets you allowlist, blocklist, or require approval before installation. Vet items publicly with the free MCP Server Security Hub and Skills Security Scanner, or apply the same protection across every endpoint through the enterprise platform. It's how security teams say YES to MCP adoption without losing control.

How does Backslash detect prompt injection and data exfiltration threats in real time?

Backslash watches the agentic fabric live and flags or blocks risky behavior as it happens: prompt injection, tool poisoning, scope abuse, data exfiltration, and suspicious agent activity. Real-time protection is the third step of the platform, after visibility and governance, so threats are caught and contained before they reach sensitive data or external systems.

How does Backslash help with compliance audits and forensic investigation for AI agents?

Backslash creates an audit trail of harness-layer events: prompt injection activity, MCP communications, agent network access, and file access. That trail feeds compliance reporting and incident investigation.

How is Backslash different from EDR, DLP, and legacy application security tools?

Backslash operates at the agentic fabric layer where AI activity executes on the endpoint, and that's a layer none of EDR, DLP, AppSec, or network gateways cover. EDR sees processes but doesn't understand AI agents or MCP traffic. DLPs and network gateways sit on the network, but agentic threats happen on the endpoint. Legacy application security tools inspect code; Backslash governs the AI infrastructure that creates and runs it.

Secure AI Agents with Agentic AI Security

What Backslash does

Backslash covers the full agentic AI fabric on the endpoint -
from inventory to per-tool policy to inline enforcement.

Continuous Discovery and Visibility

Every endpoint, agent, model, MCP, hook, plug-in, and skill
User identities and credentials used
Permissions, data paths and network connections

Continuously scanning·312 endpointsupdated 12s ago

Agents304MCPs & Tools188Hooks94Skills141Models549

Search agents, identities, toolsRisk:All Identity:All

AgentOSIdentityAccessRisk Status

Claude Code

macOS 25.3

Dave Cohenpersonal

ReadWriteNet

Critical

Review

Cursor

Windows 11

Aaron Allenpersonal

ReadWriteNet

High

Codex

macOS 25.3

Abigail HayesSSO

ReadWriteNet

Medium

Devin

Windows 11

Adam SmithSSO

ReadWriteNet

Medium

Antigravity

macOS 25.3

Alex ButlerSSO

ReadWriteNet

No Risk

Claude Code — Dave Cohen

AG-1042 · seen 12s ago

Critical

macOS 25.3v2.1.43 MCP · 1 skill

Attached components

claude-code · v2.1.4

[email protected]Critical

ops-mcp · shellHigh

deploy-helperHigh

dave.cohen@gmailNot SSO

dave-mbp · personal credsOpen asset

412Endpoints

1,284Components

37Critical

AgentRiskAction

Claude CodeDave Cohen · personal

CriticalReview

CursorAaron Allen · personal

HighReview

CodexAbigail Hayes · SSO

MediumMonitor

DevinAdam Smith · SSO

MediumMonitor

AntigravityAlex Butler · SSO

No RiskNone

Claude Code — Dave CohenAG-1042 · seen 12s agoCritical

macOS 25.3v2.1.43 MCP · 1 skill

Attached components

claude-code · v2.1.4agent · dave-mbp

[email protected]MCP · network + execCritical

ops-mcp · shellMCP · executeHigh

deploy-helperskill · write scopeHigh

dave.cohen@gmailidentity · personal credsNot SSO

dave-mbp · personal credsOpen asset

Ongoing Vetting and Risk Assessment

Prioritized risks including vulnerable components, excessive permissions, local network access
Detection of shadow IT, unapproved tools, use of private accounts

Continuously vetting·1,284 assets assessedupdated 12s ago

Prioritized47Vulnerable21Permissions9Shadow IT12

Search findings, assets, CVEsCategory:All Owner:All

FindingAssetEvidenceSeverity Status

Vulnerable component

[email protected]

CVE-2026-1183

Critical

Review

Private account in use

cursor · aaron.allen

personal

High

Review

Excessive permissions

support-agent-v2

write · secrets

High

Open

Local network access

ops-mcp

10.0.4.0/24

High

Open

Unapproved tool

notion-bridge-mcp

unsanctioned

Medium

Triage

Vulnerable component

[email protected] · CVE-2026-1183

9.1

npmReachableFix in 0.3.0

Exposure

claude-code · dave-mbpIn use

codex · abigail.hayesIn use

ops-mcp buildIndirect

fetch() → exec()Confirmed

Upgrade to 0.3.0PR #482

detected 2h agoFull evidence

14Critical

63High

51Medium

FindingRiskAction

Vulnerable component[email protected]

CriticalReview

Private account in usecursor · aaron.allen

HighReview

Excessive permissionssupport-agent-v2

HighOpen

Local network accessops-mcp · 10.0.4.0/24

HighOpen

Unapproved toolnotion-bridge-mcp

MediumTriage

Vulnerable component[email protected] · CVE-2026-11839.1

npmReachableFix in 0.3.0

Exposure

claude-code · dave-mbpdirect dependencyIn use

codex · abigail.hayesdirect dependencyIn use

ops-mcp buildpinned 0.2.1Indirect

fetch() → exec()path reaches sinkConfirmed

Upgrade to 0.3.0fix availablePR #482

detected 2h agoFull evidence

Granular Policies and Guardrails

Hundreds of out-of-the box rules for immediate risk reduction
Custom, AI-assisted and context-driven adaptive policies
Scoped by user, team, endpoint, component and requested action

Continuously enforcing·248 policies livelast change 4m ago

Live248Out-of-box214AI-assisted26Custom8

Search policiesScope:All From templateNew with AI

PolicySourceScopeSeverity ActionStatus

Skills attempting priv. escalation

AI-drafted

all endpoints

High

Block

Active

Block unofficial MCPs

Out-of-box

all endpoints

High

Block

Active

Block shadow agent deployment

Template

all endpoints

High

Block

Active

Deny local network

Out-of-box

10.0.0.0/8

High

Block

Active

Block agents on personal creds

AI-drafted

312 endpoints

Medium

Warn

Draft

Skills attempting escalation

P-118 · v4 · AI-drafted

Active

All endpointsEU AI ActNIS2

Rule logic

Skill requests sudo

Tool call writes /etc

Block call, hold session

Slack #sec-agents

chmod 777 /etc blocked10:09

last change 4m agoVersion history

312Rules

28AI-drafted

3Drafts

PolicyRiskAction

Skills attempting escalationAI-drafted · all endpoints

HighBlock

Block unofficial MCPsOut-of-box · all endpoints

HighBlock

Block shadow agent deployTemplate · all endpoints

HighBlock

Deny local networkOut-of-box · 10.0.0.0/8

HighBlock

Agents on personal credsAI-drafted · 312 endpoints

MediumWarn

Skills attempting escalationP-118 · v4 · AI-draftedActive

All endpointsEU AI ActNIS2

Rule logic

Skill requests sudomatch · any endpoint

Tool call writes /etcmatch · ops-mcp shell

Block call, hold sessionaction · enforced inline

Slack #sec-agentsnotify · owner platform

chmod 777 /etc blockedlast event10:09

last change 4m agoEdit policy

Real-Time Protection at Execution

Risky agent actions blocked inline, before execution
Agent intent analysis and drift detection and response
Covers unauthorized code execution, credential access, privilege escalation, data sent to unapproved destinations

Inspecting inline·18,402 actions todayavg 8ms decision

Blocked62Warned118Drift9Allowed18.2k

Search actions, agentsVerdict:All Last hour

Attempted actionTargetIntentVerdictTime

Injection-triggered push

PR ← env variables

from content

Blocked