Platform
One platform from the developer's laptop to production systems.
Vekri finds the AI applications and agents where they run, inspects the tool results that pass through Vekri, authorizes each operation where it executes, and keeps the evidence that connects them.
Feature explorer
Start from what you need to secure.
Find the AI applications in use
Vekri Endpoint inventories coding agents, desktop and IDE AI apps, local models and their MCP servers; Vekri Control adds approval, risk and owners.
Vekri Endpoint
AI coding agent discovery
Finds Claude Code, OpenAI Codex CLI and GitHub Copilot CLI on a workstation, with their versions and configuration, without running them.
Vekri Endpoint
Desktop and IDE AI application discovery
Finds Claude Desktop, ChatGPT Desktop, Cursor, GitHub Copilot in VS Code and Copilot for JetBrains from their installed bundles, extensions and plugins.
Vekri Endpoint
MCP client and server inventory
Lists the MCP servers configured in each supported client (name, transport, command or host), and whether each is mediated by Vekri. Servers are never started and credential values are never read.
Vekri Control
AI Applications inventory
Every AI application and MCP server found across your organization, with approval status, an explainable risk score, owner, employees, first and last seen, and coverage taken from evidence.
Govern how employees use AI
Usage by application, team and use case from verified identity, with usage policies, alerts and privacy settings.
Vekri Observe
AI usage telemetry and Usage Explorer
One event per AI interaction across endpoint inventory, hooks, the local MCP gateway and Vekri Gateway, attributed to employees only from verified identity, with breakdowns by application, MCP server, department and use case.
Vekri Control
Employees, named or pseudonymous
AI usage per verified employee, with no productivity score or ranking. Without permission, or if the organization chooses, people are shown as stable pseudonyms.
Vekri Protect
AI usage policies on MCP calls
Rules on applications, tools and detected data, compiled to Cedar and applied by the local MCP gateway: monitor, warn, require a justification or approval, deny, ask the agent to remove detected data and repeat the call, or suggest an approved alternative.
Vekri Observe
AI usage alerts
Sensitive data in an interaction, AI usage policy outcomes and use of blocked applications, from recorded evidence, with CSV export.
Find sensitive data in AI agent traffic
On-device inspection reports categories, never content; on the local MCP gateway, policy acts before the call runs.
Vekri Endpoint
On-device sensitive-data inspection
Classifies prompts, tool inputs and MCP tool arguments on the workstation, only on the surfaces an administrator enables. Only category names and counts leave the device.
Vekri Protect
AI usage policies on MCP calls
Rules on applications, tools and detected data, compiled to Cedar and applied by the local MCP gateway: monitor, warn, require a justification or approval, deny, ask the agent to remove detected data and repeat the call, or suggest an approved alternative.
Vekri Observe
Sensitive-data findings
When on-device inspection reports a category, Observe records a finding with the category and confidence, never the content.
Vekri Control
Sensitive-data detection management
Twenty-one categories with an honest detector status, enable and disable with a reason, custom categories (exact values stored only as salted hashes), sample testing that stores nothing, revisions and rollback.
Stop prompt injection in tool results
Tool results are inspected on both gateways before the agent reads them, and your policy decides what it receives.
Vekri Gateway
Prompt-injection detection on Vekri Gateway
Each tool result is inspected for instructions aimed at the agent after the operation runs and before the agent reads it. Policy can deliver it, replace the matching text, withhold it, or hold it for a person to release once.
Vekri Endpoint
Prompt-injection detection on the local MCP gateway
Tool results from a mediated MCP server are inspected on the workstation before the AI client sees them. Only evidence reaches Vekri, which decides under policy; enforced profiles withhold when Vekri cannot be reached, once the device has received a policy.
Vekri Gateway
Embedded prompt-injection classifier
Rules on normalized and decoded text, and a classifier model embedded in the Vekri binaries. It runs without a network call or a separate service.
Vekri Protect
Prompt-injection policy
Per surface, choose monitor, alert, sanitize, block or review, the risk at which it applies, whether the classifier runs and whether to fail closed; add expiring exceptions. Every change is an audited revision.
Control MCP servers and tools
Approved servers run as managed profiles; Vekri decides every tool call sent through it, on the workstation or at Vekri Gateway.
Vekri Protect
Managed local MCP profiles
Approve an MCP server once as a profile: which clients, which tools are allowed, need approval or are denied, and for which resources. Vekri Endpoint configures it in the client and decides every tool call sent through it.
Vekri Endpoint
Local MCP gateway
Runs an approved MCP server behind vekri-endpoint, and asks Vekri to decide every tool call before it reaches the server. A denied call never runs; an enforced profile fails closed when Vekri cannot be reached, and refuses MCP resources, prompts, sampling and elicitation, which no rule governs yet.
Vekri Gateway
OAuth-protected MCP gateway
Agents reach systems through one MCP gateway. Every request carries a token for exactly one connector, verified on each call; incoming tokens are never forwarded.
Vekri Gateway
Cedar policy, deny by default
Typed operations are evaluated with Cedar. Unknown operations and policy errors are denied, and a policy revision can be simulated before it is published.
Authorize agent access to production
Every call to Kubernetes or GitHub is checked against identity, scope and Cedar policy, privileged writes need a person's approval, and a broker holds the credentials.
Vekri Gateway
Server-issued scope
A run scope for workloads, or a protected access assignment for employees, bounds which operations and resources a call may touch. The effective permission is always an intersection.
Vekri Gateway
Exact-operation approvals
A privileged write waits for another person to approve that exact operation. The approval is bound to the request's digest, short-lived and single use.
Vekri Gateway
Credential broker
The broker executes each allowed operation with its own narrowly scoped Kubernetes or GitHub App credential. The agent never receives it.
Vekri Gateway
Kubernetes connector
Typed Kubernetes operations (list pods, read logs and deployments, restart a deployment) limited to allowed namespaces.
Vekri Gateway
GitHub connector
Typed GitHub operations on allowed repositories, executed with a GitHub App installation token limited to those repositories and permissions.
Tie AI access to people and devices
SSO for employees' agents, SCIM groups, user-device bindings, workload identity and revocation in one step.
Vekri Protect
Enterprise SSO for employees' agents
Vekri is the MCP authorization server for Claude Code: OAuth with PKCE and resource indicators, federated to your OpenID Connect provider, so the agent acts as the employee.
Enterprise
SCIM 2.0 provisioning
Users and groups provisioned with SCIM 2.0. Deactivating someone ends their sessions and agent sign-ins at once; history is kept.
Vekri Protect
User-device binding
Bind devices to people through their SSO sign-in or an administrator, and require a verified binding for sensitive access.
Vekri Protect
Revocation in one step
Revoke an assignment, a profile or an employee's sign-ins; the next request fails. Deactivating someone in your directory does the same.
Investigate and prove what happened
Findings, session timelines with provenance, decisions with their evidence, coverage that must be earned, and audited exports.
Vekri Observe
Findings and triage
Behavioral, sensitive-data and prompt-injection findings with severity, owner and status, triage, notes and the session that produced them.
Vekri Observe
Session timelines with provenance
Every action in an agent session in order. Observed attempts, detections, verified gateway decisions and confirmed executions are labelled differently and never merged.
Vekri Gateway
Durable audit evidence
Intent is recorded before a write executes and the outcome after; an uncertain outcome is flagged, never retried blindly.
Vekri Protect
Protection coverage from evidence
Coverage becomes verified only on real evidence (a sign-in, an allowed call, a denied call and no known bypass), per service and resource path, never from configuration alone.
Vekri Observe
Evidence export
Export redacted evidence for a finding or a session, and inventories and alerts as CSV; each export is recorded in the audit log.
Architecture
Choose a component to see its role.
Component
AI applications and agents
Employees' coding agents, desktop and IDE AI apps, and autonomous workloads. Vekri Endpoint finds them on workstations; they reach protected systems only through Vekri Gateway or the local MCP gateway.
Component
Vekri Endpoint
On macOS and Linux workstations: discovers AI applications and their MCP servers, records what Claude Code reports through its hooks, inspects content on the device when enabled, and runs approved MCP servers behind a local gateway that asks Vekri to decide every tool call.
Component
Identity
Your identity provider (OpenID Connect) for people, SCIM 2.0 for users and groups, and Kubernetes or SPIFFE identities for workloads.
Component
Vekri Gateway
The enforcement point for production systems. Every tool call is authenticated, checked against run scope or a protected access assignment and Cedar policy, and executed by the broker with its own credentials; each result is inspected for prompt injection before the agent reads it. Writes record audit intent first.
Component
Protected systems
The systems agents act on. Vekri is a boundary for them only when the gateway is their only path: network policy and credentials leave no direct route.
Component
Vekri Observe
AI usage, endpoint and external sensor telemetry, sensitive-data and prompt-injection findings, and session timelines. Observations are evidence only; they never authorize a call.
Component
Vekri Control
The control plane: token service, AI applications, detection and policy settings, local MCP profiles, approvals, organization settings and the console. It holds the audit evidence every product writes.
One investigation
Every source, one timeline.
Finding
Prompt injection · local MCP gateway
HighInvestigating · Sam
Note: source issue reported to the project owner.
Session timeline
ws-dev-07 · Claude Code
- 10:42:07Session started · Claude CodeObserved
- 10:42:31MCP call issues.get_issue · allowedVerified decision
- 10:42:32Result withheld · 2 rules · score 0.97Detected
- 10:42:40Bash: curl to an external hostObserved
Related decision
Policy revision 12
Surface: local MCP result · action block · the agent received a withheld notice.
Evidence exported
Export recorded in the audit log
What happens
Products
The five parts of Vekri.
- Protect
Vekri Gateway
Runtime authorization for every agent tool call.
Learn more - Discover
Vekri Endpoint
AI application discovery, MCP gateways and agent control on workstations.
Learn more - Investigate
Vekri Observe
AI usage, findings and investigations with evidence you can trust.
Learn more - Protect
Vekri Protect
Policies and governed access for employees' AI.
Learn more - Operate
Vekri Control
One console for AI applications, policy, approvals and evidence.
Learn more
Contact Sales
See Vekri with your own AI applications, agents and systems.
Talk to us about the AI your organization uses, the systems agents reach and how you deploy: in Vekri's cloud, or inside your own Kubernetes cluster.