Anomity is a product by Anomity in the Agentic AI Security category. It covers Agentic AI Security, Shadow AI and MCP Security.

What is the pricing for Anomity?

Anomity is a commercial product. For pricing, visit https://anomity.ai/#features or contact Anomity.

What are alternatives to Anomity?

Alternatives to Anomity listed on CybersecTools: 1. Agen.co Platform - Identity-native platform that discovers, brokers, governs, and audits AI agents. (Commercial) 2. Evoke Security - Agentic AI security platform for inventory, posture mgmt, and threat detection. (Commercial) 3. Golf MCP Control Plane - Governance & visibility platform for MCP servers and AI agent connections. (Commercial) 4. Mint Security - Platform for securing agentic AI systems via operational boundary enforcement. (Commercial) 5. Onyx Platform - AI control plane for enterprise AI agent security, governance, and observability. (Commercial) Compare all Anomity alternatives at https://cybersectools.com/alternatives/anomity

What deployment and organization size does Anomity fit?

Anomity is available as cloud or on-premises (hybrid). It is listed for small businesses, mid-market companies and enterprises. Pricing is commercial. Ask Anomity for pricing and support terms.

Anomity

byAnomityClaimed

Discovers shadow AI and enforces policy on AI agent tool calls via hooks

AI Security Agentic AI SecurityHybridSMB · Mid-Market · EnterpriseCommercial

Visit website

What is Anomity?

Anomity discovers and governs AI usage across managed endpoints, browsers, and cloud tenants.

Discovery covers twelve AI surfaces: AI agents, MCP servers, IDE extensions, skills, plugins, secrets, hooks, CLIs, AI sites and sign-ins, local LLM runtimes, browser extensions, and cloud AI apps holding OAuth grants. Artifacts are classified (for example official, community, or unknown MCP servers) and mapped to the capabilities they can reach, such as filesystem, shell, network, or credentials.

Runtime enforcement works as a hook handler on agents that expose a hook interface (for example the PreToolUse event on Claude Code). Each tool call is evaluated against policy and receives an allow or deny decision before it runs. Policy examples include blocking blanket Bash(*) permissions, restricting to approved MCPs, and blocking plaintext secrets.

Three collectors are used:

Endpoint: detects agents running in unattended mode and agents that gain an MCP server or permission mid-session.
Browser: a managed Chrome and Edge extension covering 311 classified AI web services, identifying corporate vs personal sign-ins, and redacting or blocking credentials entered into AI sites.
Cloud: read-only connectors to Google Workspace and GitHub that find third-party AI apps with OAuth scopes, score the scopes, identify who granted them, and allow revocation from the console.

Other capabilities include on-device content scanning of skills and instruction files, secrets redacted on the endpoint, a 90-day audit trail of changes and tool-call decisions, and routing of denies to SIEM, Slack, email, and Jira. The vendor states it is SOC 2 Type II attested and collects metadata only, not source code or prompts.