Anomity

Anomity is a security platform for discovering and governing AI usage inside organizations, including shadow AI. It targets security teams that need visibility into AI agents, tools and services used on managed endpoints, in browsers and in cloud tenants.

The product uses three collectors. A lightweight Endpoint Sensor (Windows, macOS, Linux) inventories AI agents, MCP servers, IDE extensions, plugins, skills, hooks, CLIs, local LLM runtimes and plaintext secrets, and sends metadata over HTTPS to Anomity Cloud. A managed Chrome and Edge browser extension covers 311 classified AI web services, shows which accounts (corporate or personal) are signed in, and can redact or block credentials entered into them.

Read-only connectors to Google Workspace and GitHub identify third-party AI applications holding OAuth grants on a tenant, rate their scopes, and allow revocation from the console.

For enforcement, Anomity runs as a hook handler on agents that expose a hook interface, such as the PreToolUse event in Claude Code. It evaluates each tool call against customer-defined policy and returns an allow or deny decision before the call runs. Denials can be routed to SIEM, Slack, email and Jira. Decisions and configuration changes are kept in a 90-day audit trail.

Other stated capabilities include trust classification of artifacts (official, community, unknown), capability mapping, on-device content scanning of skills, a CycloneDX AI bill of materials, and compliance mapping to SOC 2, ISO 42001/42005, NIST AI RMF, the EU AI Act and OWASP LLM Top 10.

The company states it is SOC 2 Type II attested, collects metadata only (not source code or prompts), and keeps secrets on the endpoint. It reports membership in the NVIDIA Inception Program and Anthropic's Cyber Verification Program.