Vekri vs Harmonic

Not covered. Discovering AI use in browsers needs a browser extension, which Vekri does not have.

A managed browser extension for Chrome, Edge, Firefox, Safari and other browsers reports AI app use, including prompts, and tells corporate from personal accounts. [1] [2]

Claude Desktop and ChatGPT Desktop on macOS, found from their installed bundles; Claude Cowork as part of Claude Desktop.

The endpoint agent identifies desktop AI apps such as Claude Desktop, ChatGPT Desktop and Claude Cowork, in the same inventory as browser apps. [3] [7]

Claude Code, Codex CLI, GitHub Copilot CLI, Cursor and Copilot in VS Code on macOS and Linux, with versions and configuration.

Discovers coding agents and IDE tools, including Claude Code, Codex CLI, Cursor and GitHub Copilot, on endpoints. [3] [5] [6]

The servers in each supported client's configuration, and whether Vekri mediates each one. Credential values are never read.

Discovers MCP clients and servers and which employees use them; each server has access groups and a count of access requests. [8] [9] [10]

Ollama and its installed models, through Ollama's local API. Prompts are never read.

Harmonic's solution pages say the endpoint agent identifies locally hosted models such as Ollama and attributes their use. [3] [8]

Not covered.

The endpoint agent detects connections to AI inference endpoints and ties each to the process and user that made it. [3] [7]

Usage Explorer by application, MCP server, department and use case, attributed only from verified identity, with pseudonymous views.

Usage Explorer and employee profiles show activity, tasks and use cases; departments come from an Entra ID, Okta or Google Workspace integration. [11] [12]

Approval status for every application and server, and a risk score that explains its factors and stays unknown without evidence.

An approved-apps group marks sanctioned tools, and each app is rated on four factors drawn from the vendor's public documents. [13] [14]

Twenty-one categories, inspected on the device in Claude Code prompts, tool inputs and MCP arguments. Off by default; context categories are keyword rules. Files and browsers are not inspected.

Detection types evaluated by Harmonic's own language models, for prompts in many apps and for uploaded files, in many languages; the same checks apply to MCP tool calls and coding-agent hooks. [15] [33]

Built-in detectors for API keys and secrets, cloud credentials and private keys.

An access-keys detection for prompts and files; the MCP gateway checks tool calls for secrets and credentials. [9] [15]

Custom categories with keywords, regular expressions or exact values, kept only as salted hashes; tested on samples without storing them.

Named custom keyword detections for prompt text, file names and file contents, tested against recent prompts before publishing. [16]

Every tool result on Vekri Gateway and the local MCP gateway is inspected before the agent reads it. On a held-out test set the default found 59% of injections at an 8% false-positive rate.

Harmonic's pricing page lists prompt-injection detection and blocking as coming soon; we found no shipped capability in its documentation. [17]

Rules and pattern detectors, and for prompt injection a classifier model embedded in Vekri's binaries. No external service is called.

Purpose-built small language models classify intent and content; Harmonic reports far fewer false positives than pattern matching. [18] [15]

On the device for sensitive data, and inside Vekri for tool results (in your own cluster when self-hosted). Only categories, counts and rule evidence are kept.

Harmonic describes models on the endpoint and local MCP enforcement; its documentation also says the browser extension sends prompts to the Harmonic platform, stored in the customer's region. [19] [2] [20]

Thirteen rules and two sequences on the device, such as a secret read followed by network egress, from Claude Code's hook events.

We found no behavioral analytics on users or agents; Harmonic classifies use cases and flags risky workflows. [11]

Not covered: Vekri has no browser extension.

Allow, advise, warn or block apps and sensitive data in the browser, by user, group, department, app plan and personal or corporate account. [21] [39]

Hooks observe Claude Code's prompts and built-in tools but do not block them; blocking built-in tools is planned. MCP calls are decided by the local MCP gateway, and agent control can stop an agent the organization has not allowed from running.

Hook-based inline controls, generally available since September 2026, cover prompts and tool calls in Claude Code, Codex CLI, Cursor, GitHub Copilot CLI and other agents. [5] [6]

Approved servers run behind vekri-endpoint on macOS and Linux; Vekri decides every tool call sent through it, and enforced profiles fail closed. Claude Code verified connecting; tool calls verified with an MCP client library.

A local MCP gateway on Windows, macOS and Linux proxies stdio and HTTP servers and applies access and data-protection rules; it is off by default. [9] [22] [24]

Vekri Gateway serves typed tools for Kubernetes, GitHub and more, self-hosted or in Vekri's cloud, and on macOS Vekri Endpoint's network gateway mediates MCP requests to approved remote servers.

A hosted Cloud MCP Gateway, in early access since August 2026, for remote servers that use the standard MCP OAuth flow. [23] [38]

Each profile lists the tools that are allowed, need approval or are denied, compiled to Cedar. Unknown operations are denied.

Access groups per server allow or deny tools, prompts and resources; when several groups match, the most permissive setting applies. [10]

Typed operations on named resources (repositories, namespaces), bounded by a run scope or an access assignment.

Documented controls apply per server, capability category and tool; rules on a specific resource or on tool arguments are not described. [10] [17]

A privileged call waits for another person to approve that operation. The approval is bound to its digest, short-lived and single use.

An access request lets an administrator grant someone access to an MCP server; approval of a single tool call is not described. [10] [38]

Warn, require a justification or approval, or suggest an approved alternative, on MCP calls through the local MCP gateway only.

Advisory banners, warnings with an optional or required justification, and block-and-edit, with custom messages; warnings do not apply to MCP. [21]

A broker executes each allowed operation with its own narrowly scoped credential. Incoming tokens are never forwarded.

The local gateway runs OAuth itself and keeps tokens in its own directory on the device; the cloud gateway handles upstream OAuth (early access). [23] [24]

OpenID Connect providers per organization for the console, the API and employees' agents. SAML sign-in is planned.

Self-service Entra ID sign-in to the portal; Okta, Google Workspace, SAML or OIDC set up by Harmonic on request. [25]

Vekri is the MCP authorization server for Claude Code, federated to your identity provider; tokens are bound to one service.

Clients sign in to Harmonic's cloud MCP gateway (early access); on devices, activity is attributed to the device's user. [23] [4]

SCIM 2.0 users and groups; deactivating someone revokes their sessions and agent sign-ins at once.

Read-only sync from Entra ID and Okta enriches employee records with department, title and groups; SCIM provisioning is not described. [12] [26]

Devices are bound to people through SSO or an administrator, and sensitive access can require a verified binding.

The agent finds the device user's email, and events carry the device's hardware identifier and operating system. [27] [32]

Kubernetes service-account tokens checked with TokenReview, or SPIFFE X.509 certificates.

Harmonic attributes activity to employees and their devices; identity for agents running as workloads is not described.

Organization roles from org-owner to viewer, mapped from directory groups by their stable ids; every route checks its permission on the server.

Six predefined portal roles with a published permission matrix that gates content, investigations, configuration and exports. [28]

Vekri's cloud.

Hosted by Harmonic on AWS in the EU or the US; data stays in the assigned region. [20]

One Helm chart in your Kubernetes cluster, with no connection to Vekri required.

Public material describes only deployment hosted by Harmonic. [20] [17]

Detection, including the prompt-injection classifier, runs inside the installation, with no call to Vekri.

An offline mode is not described: Harmonic's documentation says content is analysed on its platform and local gateway policies sync from it. [2] [9] [20]

Not supported yet: Vekri Endpoint builds for Windows, but nothing has been tested there.

The agent runs on 64-bit Windows 11 and installs from an MSI. [27] [4]

macOS and Linux, as a per-user service with no administrator rights.

Apple Silicon Macs, and Ubuntu and Rocky Linux on x86_64. [29] [30]

Signed and notarized packages for device management are planned.

Guides for Intune, Jamf, Kandji, Workspace ONE and other tools, with release groups to stage new versions. [4] [31]

Intent is recorded before a write runs and the outcome after; explanations are built only from what was recorded.

The MCP gateway logs each tool call with its parameters, response and user; a full prompt audit log is an add-on. [9] [17]

Findings with severity, owner and status, session timelines that label where each event came from, and alerts.

An alerts page with search, saved views and detail panels, and webhooks to a SIEM, ticketing tool or chat. [15] [32]

Simulate a decision or a profile, preview a policy's impact on recorded activity, and test detection on samples.

Custom keyword detections are tested against past prompts, and monitor mode supports staged rollout; no dry run for scenarios or MCP access groups is described. [16] [21] [33]

Coverage becomes verified only from evidence: a sign-in, an allowed call, a denied call and no known bypass.

Deployment monitoring for the browser extension, a detection catalog and test phrases; no report proves that all agent traffic passes through Harmonic. [34] [40]

Names shown by role or never, a minimum group size for breakdowns, and retention, all set in the console.

Identity masking (enabled by Harmonic support), per-employee exclusion, and retention periods changeable on request. [35] [20]

Redacted evidence and CSV exports, each recorded in the audit log.

CSV exports of usage, applications, employees and alerts, and webhooks; a data-lake stream is an add-on. [36] [32]

Not possible by design: Vekri does not keep prompts or tool results, so it cannot rescan them.

Custom detections are tested against recent prompts, and a connector can backfill up to a month of Anthropic activity, within retention. [16] [37]