Shadow AI discovery, starting on the device.
Discover AI tools, coding agents, local models and MCP connections across enrolled devices. Turn scattered installations into an inventory your teams can investigate.
An installed app is only the beginning. Surface adds the account, credential and access context needed to decide what to review.
The Layer 1 Agent reads supported local signals to identify AI tools and their configuration. No seed list, per-tool API integration or execution of discovered tools is needed.
Connect each discovery to its reporting device, account context and declared connections. Model Context Protocol (MCP) servers bring external tools and data into an agent’s reach.
New reports update the inventory as tools appear, configuration changes or devices go quiet. Missing data remains visible instead of looking like a clean device.
The published collection model spans 21 signals. Availability depends on the operating system, tool and configuration.
Installed tools, local models and configured autonomy.
ai_tooling · ai_autonomySupported browser AI usage and installed software.
ai_web_usage · installed_softwareMCP configuration, external hosts and credential presence.
mcp_servers · ai_credentialsAccount context, available usage and project relationships.
ai_accounts · ai_usage · ai_projectsDevice facts, management, updates, encryption and other endpoint checks.
12 device and security signalsWant to inspect local discovery first? Explore open-source Surface ↗. It is a separate tool, not the managed agent or the full EndLayer platform.
Surface describes the environment in which AI runs. Discovery does not need to inspect traffic or execute the AI tools it finds.
Record supported tools and configuration. Prompt and response collection is off by default and requires an explicit administrator choice.
Report that a credential exists, without exposing its value. Declared repository context does not mean source-code contents are collected.
A disabled collector, an unrecognised tool and an empty result are different states. Validate the tools your teams use during the pilot.
Enrol representative macOS, Windows and Linux devices. Review what is found, then expand with your existing device-management tooling.
Explore agent rollout →See the Guardian Agent Platform on your own fleet. Find every AI tool, understand what it reaches and costs, and apply the controls your team needs.