Anomity

Anomity discovers and governs AI usage across managed endpoints, browsers, and cloud tenants. Discovery covers twelve AI surfaces: AI agents, MCP servers, IDE extensions, skills, plugins, secrets, hooks, CLIs, AI sites and sign-ins, local LLM runtimes, browser extensions, and cloud AI apps holding OAuth grants. Artifacts are classified (for example official, community, or unknown MCP servers) and mapped to the capabilities they can reach, such as filesystem, shell, network, or credentials. Runtime enforcement works as a hook handler on agents that expose a hook interface (for example the PreToolUse event on Claude Code). Each tool call is evaluated against policy and receives an allow or deny decision before it runs. Policy examples include blocking blanket Bash(*) permissions, restricting to approved MCPs, and blocking plaintext secrets. Three collectors are used: - Endpoint: detects agents running in unattended mode and agents that gain an MCP server or permission mid-session. - Browser: a managed Chrome and Edge extension covering 311 classified AI web services, identifying corporate vs personal sign-ins, and redacting or blocking credentials entered into AI sites. - Cloud: read-only connectors to Google Workspace and GitHub that find third-party AI apps with OAuth scopes, score the scopes, identify who granted them, and allow revocation from the console. Other capabilities include on-device content scanning of skills and instruction files, secrets redacted on the endpoint, a 90-day audit trail of changes and tool-call decisions, and routing of denies to SIEM, Slack, email, and Jira. The vendor states it is SOC 2 Type II attested and collects metadata only, not source code or prompts.