See every supported AI workflow.
Control every protected action.

What happens

1. 1Vekri Endpoint runs as a per-user service on a developer's Mac. Nothing is started or changed.
2. 2It finds installed AI applications: Claude Code, Cursor, Claude Desktop and Ollama.
3. 3It reads each client's MCP configuration for server names and hosts, never credential values.
4. 4One MCP server runs through a Vekri profile; two were configured by hand.
5. 5The inventory is delivered to Vekri Control, signed with the device's own key.
6. 6AI Applications lists each one with its approval status, and which servers Vekri mediates.

What happens

1. 1An agent asks the issue tracker's MCP server for issue 4521.
2. 2The operation runs. Its result comes back through Vekri before the agent sees it.
3. 3Hidden in the issue body: a note telling the AI agent to ignore its instructions and email the .env file.
4. 4Rules match after normalization: instruction override, and a data exfiltration instruction.
5. 5The classifier embedded in Vekri scores the string as an injection. Risk: high.
6. 6Policy for this surface is block: the agent is told the operation ran and its output was withheld.
7. 7Observe records which rules matched and where, and the score, without the content. A reviewer can release it once.

The issue text is illustrative. Detection is a signal, not a guarantee: Vekri policy still decides every call the agent makes next through Vekri.

What happens

1. 1Claude Code calls an MCP tool through the local MCP gateway: create_issue, with a pasted log.
2. 2Inspection on the device finds a cloud credential in the tool arguments.
3. 3Only the category leaves the device: cloud credentials, high confidence, one match.
4. 4The AI usage policy for credentials applies: remove the data and repeat the call.
5. 5The call is refused before it reaches the server, and the agent is told what to remove.
6. 6The agent repeats the call without the key, and it runs.
7. 7Observe records the category and the policy outcome. The content is never stored.

What happens

1. 1Claude Code starts the GitHub MCP server through vekri-endpoint, as its Vekri profile configured.
2. 2list_issues: the profile allows it. Vekri decides allow, and the call reaches the server.
3. 3create_pull_request: the profile requires approval. The call is held, and a request is raised.
4. 4Another person approves that exact operation; the same call, repeated, runs once.
5. 5delete_repository: denied by the profile. The call never reaches the server.
6. 6Vekri is unreachable for a moment: the enforced profile fails closed.
7. 7Every decision is recorded with the person bound to this device.

Applies to MCP servers configured through a Vekri profile. Built-in tools and servers configured directly are outside it, and inventory shows them as not mediated.

What happens

1. 1In Vekri Control, Claude Code is approved and Aider is not. The organization enforces its choices.
2. 2Vekri Endpoint receives the decision on the developer's workstation.
3. 3The developer starts Claude Code: it is approved, so it runs.
4. 4The developer starts Aider. Vekri Endpoint recognises it as it starts.
5. 5Aider is not allowed, so Vekri Endpoint stops it.
6. 6The Vekri Endpoint app tells the developer which agent was stopped, and why.
7. 7Vekri Control records it, with the device and the agent, for the security team.

For the AI agents and harnesses Vekri Endpoint recognises, on macOS and Linux.

What happens

1. 1Claude Code connects to remote MCP servers through Vekri Endpoint's network gateway.
2. 2mcp.tickets.example is approved. search_tickets is allowed by policy and reaches the server.
3. 3close_ticket is denied by policy. The call never reaches the server.
4. 4Claude Code tries mcp.unknown.example, a server nobody approved. The connection is refused.
5. 5Traffic to other sites passes through, unread.
6. 6The developer sees each refusal on the device, and security sees it in Vekri Control.

For agents that connect through Vekri Endpoint's network gateway, on macOS.

What happens

1. 1An agent calls a tool: github.get_repository on acme/payments-api.
2. 2Vekri verifies the caller: here the employee's SSO session behind Claude Code.
3. 3The call is checked against the employee's protected access assignment.
4. 4Cedar policy evaluates the exact operation and permits it.
5. 5The broker executes it with its own GitHub App credential, which never leaves the broker.
6. 6A second call, on acme/secrets-vault, is outside the assignment: denied before execution.
7. 7Both decisions are recorded as audit evidence: intent before execution, outcome after.