Traditional EDR and DLP watch processes and files. They are blind to the AI layer — they can't tell you that a laptop is running an unsanctioned AI agent, leaking an API key to an LLM, or shipping code a developer never actually reviewed. Araghatta is the EDR for AI: a single lightweight agent that discovers, attributes and scores unsanctioned AI across every endpoint — macOS, Linux and Windows — and streams the evidence straight into your SIEM.
What the sensor sees
AI CLIs & agents
Claude Code, Ollama, LangChain/agent runtimes and other AI CLIs on PATH or running.
Provider API keys
OpenAI / Anthropic / etc. keys in env, .env files and shell profiles — fingerprinted at the source.
MCP servers & tool scope
MCP config parsed for servers, packages, versions, pins — and the fs / shell / network tool scope granted.
IDE AI assistants
Copilot, Cursor, Cody, Continue, Amazon Q, Tabnine — enumerated by marketplace ID, with account and version.
Skills files & provenance
Downloaded SKILL.md and agent skills — executable instructions, tied to their unverified source repo.
LLM SDK usage
openai / anthropic / langchain SDKs imported in running processes and manifests.
Installed AI apps
Desktop AI apps (Cursor, ChatGPT, Monica, …) present on the device.
Browser AI extensions
Chromium & Firefox extensions flagged as AI by id/keyword.
Egress to AI endpoints
Live connections to AI/LLM services — matched by host, process and resolved IP.
Autonomous agents
Orchestrators running with AI — LangChain, CrewAI, AutoGen, MCP loops — flagged when they run unattended.
Vibe-coded repos
Repositories where AI wrote the code — Cursor / Copilot / Claude footprints reaching production without review.
Non-human identities
Agent & service credentials, and offboarded users still holding live AI access.
Why now
Find the AI users your EDR isn't protecting
The sensor detects whether an endpoint has EDR running — CrowdStrike Falcon, SentinelOne, Microsoft Defender for Endpoint, Carbon Black, Cortex XDR and more — and crosses it with AI usage to answer the single most useful question in one view: “which machines are running AI tools with no endpoint protection?” — a coverage gap you can close immediately.
Detect → Attribute → Report to your SIEM
Detection is the start. Every finding is attributed to a device, user and account, scored separately on risk and threat, and streamed to your SIEM with full context — so it lands in the workflow your SOC already lives in. The sensor is observe-only by design; a coarse host/process deny-list is available opt-in (off by default, advanced), and AI-aware host/agent blocking plus inline browser DLP are on the roadmap.
Splunk
HTTP Event Collector (HEC)
Microsoft Sentinel
Log Analytics connector
IBM QRadar
syslog / LEEF
Elastic Security
Elasticsearch / ECS
Google Chronicle
ingestion API
Any SIEM
generic syslog / CEF + webhook
Govern your AI-generated code — “Vibe Coding”
The loop nobody else closes: the platform detects the AI code → reviews it → an engineer approves it. AI-generated code, governed end-to-end.
Cloud-server CSPM: connect the AI agent to the cloud blast radius.
On EC2, Azure VMs and Google Compute Engine, the self-contained sensor identifies the AI process or autonomous agent, its user or service identity, tool scope, network context and access to local workload services. A least-privilege, read-only AWS connector supplies control-plane evidence today; Azure and Google Cloud connectors are being brought online. The platform joins the two views instead of treating a host finding and a cloud misconfiguration as unrelated alerts.
Agent capability
Process, parent, package, service/container, unattended state, shell or code-execution tool scope, network access and credential references—with usable secret values excluded.
Metadata and identity
IMDSv1/IMDSv2 posture on AWS today — with managed-identity metadata on Azure and service-account metadata on Google Cloud as those connectors come online — and the effective permissions attached to the workload.
Reachable data and services
Correlates the runtime with Amazon S3 today (Azure Storage and Google Cloud Storage on connect) and other authorised resources to identify the shortest defensible remediation path.
Capabilities
| Capability | What it delivers |
|---|---|
| Full-surface AI detection | Eleven signal classes — AI CLIs & agents, keys, MCP & tool scope, IDE assistants, skills, SDKs, apps, extensions, egress, vibe-coded repos, cloud-server CSPM — one normalized platform |
| Cross-platform + mobile | Windows, macOS and Linux from a single self-contained binary (Windows Server in beta); iOS & Android AI-app discovery alongside |
| Two-axis severity | Operational risk and active threat scored separately, each on a capability-specific rubric |
| Continuous threat intel | NVD · CISA KEV · OSV + curated agent TTPs correlated to your fleet — Slack & email alerts on new exposures |
| Rogue-agent detection | Unattended orchestrators, HuggingFace pulls, confused-deputy MCP abuse — mapped to MITRE ATLAS & ATT&CK |
| Cloud-server CSPM & agent attack paths | Correlates AI runtime and tool scope with metadata-service posture, effective workload identity, cloud policies and reachable storage/services — AWS today; Azure & Google Cloud on connect |
| Risk posture & AI-BOM | Per-host risk score plus a complete AI Bill-of-Materials, with vulnerable AI components matched against CISA KEV / NVD / OSV |
| Supply-chain provenance | Where each MCP server / skill came from — official registry vs unofficial Git vs unknown — so governance is by source + scope, not an impossible allow-list |
| Device trust & response | Revoke a stolen/rogue device (server-enforced cutoff), attest the sensor binary against releases, tamper-resistant service, remote-pause — all operator-authorised and audited |
| EDR-coverage gap | Surface every endpoint running AI with no endpoint protection |
| Report & stream | Every finding to Splunk, Sentinel, QRadar, Elastic, Chronicle — plus Jira, Slack and OCSF / Amazon Security Lake |
| AI-code governance | Detect AI-generated code and route it for security review |
| Privacy-first deployment | Observe-only by default, MDM install, secrets masked on the endpoint |
| Compliance evidence | AI-BOM and governance exports mapped to EU AI Act and NIST AI RMF |
What runs on which OS — honestly.
Discovery is identical everywhere. Real-time tracing differs by platform, and active enforcement is still on the roadmap — we'd rather tell you than let you find out. The sensor is observe-only today; when enforcement ships it will be opt-in and fully audited.
| Capability | Windows | macOS | Linux |
|---|---|---|---|
| AI discovery — 11 signal classes, AI-BOM, risk + threat scoring | GA | GA | GA |
| Real-time exec & connect tracing | scheduled | scheduled | eBPF · GA |
| Inline AI-DLP (browser) — block secrets/source before send | roadmap | roadmap | roadmap |
| Policy enforcement — host/process deny-list (opt-in, off by default, advanced) | opt-in | opt-in | opt-in |
| AI-aware enforcement — block a denied AI host / quarantine an agent | roadmap | roadmap | roadmap |
| Remote pause — stop a sensor’s collection from the console | GA | GA | GA |
| Device revocation — cut off a stolen/rogue device (token rejected server-side, re-enroll blocked) | GA | GA | GA |
| Device attestation — sensor binary verified against the published releases | GA | GA | GA |
| Tamper-resistant service — runs as a system service a standard user can’t stop or uninstall (removal needs admin/MDM) | GA | GA | GA |
| Compliance evidence + SIEM streaming | GA | GA | GA |
Real-time exec/connect tracing is Linux-first (eBPF) and expanding to macOS & Windows. Today the only enforcement is an opt-in, off-by-default host/process deny-list (advanced, root-required, not AI-aware); AI-aware host/agent blocking and inline browser DLP are on the roadmap. Discovery, attribution, scoring and evidence are identical across all three platforms today.
Deploys in minutes. Observe-only by default.
One self-contained binary
A single self-contained agent per OS, pushed via your MDM (Intune, Jamf, …), verified by SHA-256 checksum. No agent sprawl, no dependencies.
Privacy-first
Observe-only by default. Secrets are masked on the endpoint; key values never leave the device. When enforcement ships it will be opt-in and fully audited.
Your data, encrypted
TLS in transit, encrypted at rest, per-device enrolment tokens.
Evidence for auditors
Export an AI-BOM and governance evidence mapped to EU AI Act and NIST AI RMF.
Start a free trial Book a 30-min demo