Skip to content

Vekri Endpoint

See the AI on your workstations, decide its MCP calls, and choose which agents run.

Vekri Endpoint finds coding agents, desktop AI apps, IDE assistants, local models and their MCP servers on macOS and Linux. It records what Claude Code reports through its hooks, inspects content on the device when you enable it, and runs approved MCP servers behind a local gateway that asks Vekri to decide each tool call sent through it. On macOS, its network gateway does the same for remote MCP servers, and agent control stops AI agents your organization has not allowed.

Contact SalesRequest a Demo

  • An inventory you can trust

    Know which AI applications and MCP servers run where, and which ones Vekri actually mediates.

  • Control where the agent runs

    Approved MCP servers run behind the local or network MCP gateway, so a denied call never reaches the server, and agents you have not allowed are stopped when they start.

  • Private by design

    Content inspection runs on the device and is off until you enable it. Only categories and counts leave the workstation.

See it work

Vekri Endpoint, step by step.

Vekri Endpoint: discovery and detection
Illustrative data

Workstation ws-dev-07 · macOS

Claude Code

Session started · repo payments-api

vekri-endpoint

Hook events, recorded

Claude Code discovered · hooks installed
Rule matched: cred.cloud_credentials_access

Hook events on this device

  • ObservedPreToolUse · Read~/.aws/credentials
  • HighFinding createdAgent accessed cloud or cluster credentials

Vekri Observe · Findings

Triage queue

HighAgent accessed cloud or cluster credentials

ws-dev-07 · claude-code · Vekri Endpoint · Live

Signed with the device key · prompts and file contents never leave the device

What happens

Hooks are monitor only: they record what Claude Code reports and never block. MCP tool calls are decided by the local MCP gateway. Vekri Endpoint is not a full operating-system monitor.

AI agent control
Illustrative data

Vekri Control

Protect → AI agents · enforce

Claude Code · approved
Aider · not allowed
StoppedAider

ws-dev-07 · user:erin · just now

Workstation ws-dev-07 · macOS

vekri-endpoint

Agent control

Decision received · enforce
claude · approved, running
aider · stopped

Terminal

erin@ws-dev-07

$ claude

Claude Code is running

$ aider

Stopped: Aider

Vekri Endpoint stopped Aider. Your organization has not approved this agent.

What happens

For the AI agents and harnesses Vekri Endpoint recognises, on macOS and Linux.

Remote MCP connections
Illustrative data

Claude Code

On Erin's laptop

Vekri

Approved servers · Cedar

vekri-endpoint

Network gateway

search_tickets · allow
close_ticket · deny (policy)
mcp.unknown.example · not approved
Other sites · passed through, unread

Refused: server not approved

mcp.tickets.example

Approved MCP server

Received: search_tickets

Never received: close_ticket

mcp.unknown.example

Not approved

Never reached

Vekri Control · ws-dev-07 · user:erin

  • Allowedsearch_tickets
  • Deniedclose_ticketnot executed
  • Refusedmcp.unknown.exampleserver not approved

What happens

For agents that connect through Vekri Endpoint's network gateway, on macOS.

Capabilities

What Vekri Endpoint does.

Each item is in the current release and verified by tests in the product repository, with its limits beside it.

  • AI coding agent discovery

    Finds Claude Code, OpenAI Codex CLI and GitHub Copilot CLI on a workstation, with their versions and configuration, without running them.

    Vekri Endpoint inventory · macOS, Linux

  • Desktop and IDE AI application discovery

    Finds Claude Desktop, ChatGPT Desktop, Cursor, GitHub Copilot in VS Code and Copilot for JetBrains from their installed bundles, extensions and plugins.

    Vekri Endpoint inventory · macOS, Linux

    Limit: Claude Desktop and ChatGPT Desktop are macOS only (neither has a Linux build); Cursor is discovered on macOS, its configuration on both. Copilot for JetBrains is detected from its plugin only, and Claude Cowork as part of Claude Desktop, without knowing whether it is used.

  • MCP client and server inventory

    Lists the MCP servers configured in each supported client (name, transport, command or host), and whether each is mediated by Vekri. Servers are never started and credential values are never read.

    Vekri Endpoint inventory · macOS, Linux

  • Local model runtime discovery

    Finds Ollama and lists its installed models through its local API. Prompts and completions are never read.

    Vekri Endpoint inventory · macOS, Linux

  • Agent lifecycle hooks for Claude Code

    Records the session, prompt and tool events Claude Code reports through its hooks, including its built-in shell and file tools. Monitor only: the hook never blocks.

    Claude Code hooks · macOS, Linux

  • Local behavioral detection

    Thirteen rules and two sequences run on the device, for example credential-file access, or a secret read followed by network egress.

    Claude Code hooks · macOS, Linux

  • On-device sensitive-data inspection

    Classifies prompts, tool inputs and MCP tool arguments on the workstation, only on the surfaces an administrator enables. Only category names and counts leave the device.

    Claude Code hooks · local MCP gateway · macOS, Linux

    Limit: Off by default. Hooks report after the fact; only the local MCP gateway can act before a call runs.

  • Local MCP gateway

    Runs an approved MCP server behind vekri-endpoint, and asks Vekri to decide every tool call before it reaches the server. A denied call never runs; an enforced profile fails closed when Vekri cannot be reached, and refuses MCP resources, prompts, sampling and elicitation, which no rule governs yet.

    local MCP gateway · macOS, Linux

    Limit: Governs the MCP servers configured through a Vekri profile; built-in tools (shell, file edits) and servers configured directly stay outside it, and inventory shows them as not mediated. Claude Code was verified connecting through it; in the tests, tool calls are made by an MCP client library rather than by Claude's model.

  • Network gateway for remote MCP

    A loopback proxy on the workstation decrypts only the hosts your policy names, sends MCP requests to approved remote servers through Vekri's Cedar decisions and prompt-injection inspection, and refuses unapproved MCP endpoints and blocked hosts. Other traffic is tunnelled unread.

    network gateway (remote MCP) · macOS

  • AI agent control

    Recognises 14 AI agents and harnesses when they run, among them Claude Code, Codex, Gemini CLI and Aider. Agents the organization has not allowed are recorded and, in enforce mode, stopped when they start.

    Vekri Endpoint · Protect → AI agents · macOS, Linux

  • Signed telemetry with an offline queue

    Each device enrolls with a one-time grant and signs every delivery with its own key. Events queue durably while offline, and any loss is counted and reported.

    Vekri Endpoint · macOS, Linux

  • Signed managed configuration

    Collection settings and detection rules are data signed by your deployment; devices refuse unsigned or older revisions.

    Vekri Endpoint · macOS, Linux

  • Endpoint fleet health

    Heartbeats, hook coverage, queue depth and delivery loss for each enrolled device, in Vekri Control.

    Vekri Control · macOS, Linux

  • Prompt-injection detection on the local MCP gateway

    Tool results from a mediated MCP server are inspected on the workstation before the AI client sees them. Only evidence reaches Vekri, which decides under policy; enforced profiles withhold when Vekri cannot be reached, once the device has received a policy.

    local MCP gateway · macOS, Linux

    Limit: Only results that pass through the local MCP gateway are inspected.

Support matrix

What Vekri Endpoint can do for each application.

The same levels the product reports with its inventory, taken from its capability catalog.

  • Claude Code

    Coding agent · tested with 2.1.283

    Discovery
    macOS: SupportedLinux: Supported
    MCP servers
    macOS: SupportedLinux: Supported
    Live hooks
    macOS: SupportedLinux: Supported
    Local MCP gateway
    macOS: SupportedLinux: Supported

  • OpenAI Codex CLI

    Coding agent

    Discovery
    macOS: SupportedLinux: Supported
    MCP servers
    macOS: SupportedLinux: Supported
    Live hooks
    macOS: Version-dependentLinux: Version-dependent
    Local MCP gateway
    macOS: Not yet testedLinux: Not yet tested

  • Claude Desktop

    Desktop app

    Discovery
    macOS: SupportedLinux: Unsupported
    MCP servers
    macOS: SupportedLinux: Unsupported
    Live hooks
    macOS: UnsupportedLinux: Unsupported
    Local MCP gateway
    macOS: Not yet testedLinux: Unsupported

  • Claude Cowork

    Desktop app

    Discovery
    macOS: PartialLinux: Unsupported
    MCP servers
    macOS: UnsupportedLinux: Unsupported
    Live hooks
    macOS: UnsupportedLinux: Unsupported
    Local MCP gateway
    macOS: UnsupportedLinux: Unsupported

  • ChatGPT Desktop

    Desktop app

    Discovery
    macOS: SupportedLinux: Unsupported
    MCP servers
    macOS: UnsupportedLinux: Unsupported
    Live hooks
    macOS: UnsupportedLinux: Unsupported
    Local MCP gateway
    macOS: UnsupportedLinux: Unsupported

  • Cursor

    IDE assistant

    Discovery
    macOS: SupportedLinux: Not yet tested
    MCP servers
    macOS: SupportedLinux: Supported
    Live hooks
    macOS: UnsupportedLinux: Unsupported
    Local MCP gateway
    macOS: Not yet testedLinux: Not yet tested

  • GitHub Copilot in VS Code

    IDE assistant

    Discovery
    macOS: SupportedLinux: Supported
    MCP servers
    macOS: SupportedLinux: Supported
    Live hooks
    macOS: UnsupportedLinux: Unsupported
    Local MCP gateway
    macOS: Not yet testedLinux: Not yet tested

  • GitHub Copilot CLI

    Coding agent

    Discovery
    macOS: SupportedLinux: Supported
    MCP servers
    macOS: PartialLinux: Partial
    Live hooks
    macOS: UnsupportedLinux: Unsupported
    Local MCP gateway
    macOS: Not yet testedLinux: Not yet tested

  • GitHub Copilot for JetBrains

    IDE assistant

    Discovery
    macOS: PartialLinux: Partial
    MCP servers
    macOS: UnsupportedLinux: Unsupported
    Live hooks
    macOS: UnsupportedLinux: Unsupported
    Local MCP gateway
    macOS: UnsupportedLinux: Unsupported

  • Ollama

    Local models

    Discovery
    macOS: SupportedLinux: Supported
    MCP servers
    macOS: UnsupportedLinux: Unsupported
    Live hooks
    macOS: UnsupportedLinux: Unsupported
    Local MCP gateway
    macOS: UnsupportedLinux: Unsupported
  • Windows: Vekri Endpoint builds for Windows, but nothing has been tested there yet, so no application is supported on it.
  • Supported means a test or demo in the product repository verifies it; it does not mean protected. Coverage comes from evidence: hooks reporting, or calls decided through a gateway.
  • Not yet tested means implemented or plausible but unverified, and never counted as coverage. Built-in tool denial is not enabled for any application.

Scope

What it does not claim.

Security tools earn trust by being exact about their limits.
  • Hooks observe; they never block. Blocking an agent's built-in shell and file tools is planned, not built.
  • The local MCP gateway governs the MCP servers configured through a Vekri profile. Servers configured directly are inventoried as not mediated.
  • macOS and Linux. Windows is not supported yet, and AI use in web browsers is not discovered.

The platform

Works with the rest of Vekri.

Capabilities that use Vekri Endpoint

How Vekri Endpoint compares with other tools

Contact Sales

See Vekri with your own AI applications, agents and systems.

Talk to us about the AI your organization uses, the systems agents reach and how you deploy: in Vekri's cloud, or inside your own Kubernetes cluster.

Contact SalesRequest a Demo