Endpoint AI Security

Control AI agents on employee endpoint devices.

Discover and govern employee AI agents such as Claude Code, Codex CLI, ChatGPT Desktop, Cursor, and Windsurf. Understand their tools and permissions, control unapproved capabilities, and investigate policy violations.

Claude Code
Codex CLI
ChatGPT Desktop
Cursor
Windsurf

Book a demo Explore capabilities

The Dwaar approach

Employee device
Your existing EDR / MDM
AI agent
Discover supported installations
Connected capabilities
MCP servers · tools · skills
Policy decision
Review access and enforce controls

The challenge

Employee AI adoption creates new paths to your data.

Unknown agent usage

Agents arrive on employee devices before security teams have a clear inventory of what is being used.

Excessive access

An agent connected to files, terminals, or databases can inherit access far beyond its intended task.

Unapproved extensions

New tools, MCP servers, and skills introduce capabilities that may never have passed a security review.

Capabilities

From visibility to control.

Discover endpoint agents

Use your existing EDR or MDM to deploy Dwaar Discovery and inventory supported agents across managed employee devices.

Understand connected capabilities

Bring MCP servers, tools, and skills into a registry. Review their available permissions, sources, approval status, and associated agents.

Assess access risk

Identify capabilities with sensitive access and prioritise review of untrusted tools and skills against your organisation’s policies.

Control approved usage

Restrict unapproved MCP servers, tools, and skills through supported enforcement integrations. Apply policies suited to the agent’s intended role.

Investigate policy violations

Review available agent activity and policy evidence to understand the attempted action, the rule it violated, and the outcome.

A helpful skill attempts an unwanted export.

01 / Risk
An employee adds an unapproved skill to an agent with database access. The skill attempts to export records outside the intended workflow.
02 / Policy decision
A configured enforcement integration checks the capability against the organisation’s approved-use policy.
03 / Outcome
The disallowed action is blocked at the supported control point, with policy evidence available for investigation.

An unapproved MCP server opens a path to sensitive files.

01 / Risk
An employee connects an agent to an unapproved MCP server with access to local project files.
02 / Policy decision
The connected enforcement point checks the MCP server and requested capability against the organisation’s approved registry.
03 / Outcome
The unapproved capability is restricted and the attempted access is recorded for security review.

A routine task becomes an unauthorised tool action.

01 / Risk
Instructions in a retrieved document steer an employee’s agent toward using a connected tool outside its intended task.
02 / Policy decision
The configured policy evaluates the attempted tool action against the allowed workflow and data boundaries.
03 / Outcome
The disallowed action is blocked at the supported control point, with the violation available for investigation.

Your context. Your policies.

Security policies tailored to your organisation.

Use application context, red-team findings, and available traffic analysis to inform policies that fit how your organisation works.

Dwaar’s in-house small language model (SLM) supports private policy evaluation. Choose deployment and data-handling boundaries suited to your environment, with control over sensitive policy inputs.

Discuss private deployment