Origin Endpoint AI Observability

Origin is an endpoint AI observability platform. A light user-mode sensor installs on employee devices in minutes and records AI activity where it runs, including local models and self-hosted tools that never cross the network.

Origin builds a live inventory of the AI agents, models and MCP servers across the fleet, flags unapproved and sideloaded ones, and maps usage to people through Microsoft Entra and other identity providers. Each session is rebuilt as a trace: the prompt, model turns, tool calls, file access, processes, network requests and the outcome, with every step tied to the user, endpoint, agent, model and process behind it.

Built-in signals flag credential material in prompts or tool output, sensitive file reads, unexpected egress, destructive commands, sandbox escape requests, unapproved models, customer data in prompts and poisoned tool descriptions, each linked to the trace behind it.

Analytics group AI activity into clusters by team and project, track token use and estimated cost by model, team and workflow, and answer plain-language questions over the record with links to the supporting traces. An MCP server exposes the same data to MCP clients.