CONTROL TYPE · DEV
On-device AI control: governing coding agents and AI apps where they run
Short answer
By The Device Desk · Endpoint AI Finder · Published 2026-10-11
Desk research from public vendor pages read on 27 September and 11 October 2026. Profiles follow our published method; we did not run the products.
Vendor pages read September and October 2026 · updated 2026-10-13
What does on-device control do?
Coding agents and desktop AI agents act with the permissions of the person who started them. They can read source code and credentials, run commands and call MCP servers that run on the same machine. The MCP security best practices describe local MCP servers as running with the same privileges as the client, which is why what happens on the device matters.
An on-device control does some or all of four jobs: it finds the AI agents, MCP servers, extensions and credentials on each device; it decides whether a specific action should run; it allows, asks about or blocks that action; and it records what happened and who started it.
How the product reaches the device matters as much as what it does. Some install their own agent. Some ride on tooling already there: Bay and Noma Security both state that they work through your existing EDR or MDM without a new endpoint agent. Some act inside the AI agent through its hooks or managed settings, as Lasso Security describes for Claude Code.
When do you need it?
- Developers use coding agents such as Claude Code, Codex or Cursor, with MCP servers they add themselves.
- Agents can reach secrets, production credentials or cloud CLIs from the same laptop.
- You want a decision on each action, such as asking before a package install, not only a list of tools.
- Devices are managed, so you can roll something out through EDR or device management.
What can it not see?
An on-device control sees nothing on devices it is not installed on, which rules out personal devices and most contractor laptops. It also sees little of AI used inside SaaS products or cloud workspaces, where the agent runs on someone else's server. Products differ in which agents they understand: a control that knows Claude Code's hooks may know nothing about a new agent your developers installed last week, so ask how quickly new agents are recognised.
Which finder answers point to DEV?
- +3if the answer to "Which AI tools do employees use at work?" is Desktop AI apps and agents
- +4if the answer to "Which AI tools do employees use at work?" is Coding agents and MCP servers
- +1if the answer to "Which AI tools do employees use at work?" is Not sure yet
- +2if the answer to "Do you manage the devices people use for AI?" is Yes, company-managed devices
- +1if the answer to "Where does the work happen?" is Mostly on laptops and desktops
- +1if the answer to "How sensitive is the data AI tools can reach?" is Customer data or source code
- +2if the answer to "How sensitive is the data AI tools can reach?" is Regulated data, secrets or production access
- +2if the answer to "Which of these do you already run?" is Any of Palo Alto Networks, SentinelOne, CrowdStrike, another EDR or device management (once, however many are picked)
- +2if the answer to "When an AI action looks risky, what do you want to happen?" is Block it
- +1if the answer to "When an AI action looks risky, what do you want to happen?" is Warn or ask the person
- +1if the answer to "When an AI action looks risky, what do you want to happen?" is Only watch for now
- +1if the answer to "How widely is AI used?" is Across most of the company
Which products describe on-device control?
8 of 19 products describe on-device control on the pages we read, 8 partly, and 3 are not in our sources.
| Product | Status | What their pages say | Source |
|---|---|---|---|
| AI Access Security (Palo Alto Networks) | Not in our sources | Not described on the pages we read. | None |
| Akamai Workforce Protector | Partly described | The page says its controls reach desktop applications; how that works on the device is not described on the page we read. | Source: Akamai Workforce Protector (formerly LayerX) · Read 11 Oct 2026 |
| Bay | Described | Inventories AI agents, MCP servers, tools, credentials and extensions on the device, and its Enforcer returns Allow, Ask or Deny locally on prompts, pre-tool calls and post-tool responses on supported agent surfaces. Delivered as Wave, an ephemeral binary that runs through your existing MDM or EDR. Policies can be scoped by agent, group, endpoint or device. | Source: Bay blog: Ghostjacking (re-read) · Read 11 Oct 2026 |
| Bloom Security | Partly described | Discovers software, extensions and AI on the endpoint and automatically scales back overpermissioned MCP servers; how it reaches the device is not published. | Source: Bloom Security homepage · Read 27 Sep 2026 |
| Cloudflare AI Gateway | Not in our sources | Not described on the pages we read. | None |
| CrowdStrike Falcon Guardian | Described | Discovers AI agents on supported endpoints and ties prompts, skills, tool calls, MCP servers and identity to what runs next; defines which agent types may run. | Source: CrowdStrike blog: Falcon Guardian, 1 September 2026 · Read 13 Oct 2026 |
| Ent | Described | A single lightweight agent across Windows, macOS and Linux with one programmable policy for people and AI agents. | Source: Ent press: intent-aware prevention for AI agents, 30 July 2026 · Read 13 Oct 2026 |
| Glow Security | Partly described | Software control and runtime prevention policies; a pre-execution hook can block an action or hold it for approval. | Source: Glow Security blog: AI agents exposed developer screenshots, 29 September 2026 · Read 13 Oct 2026 |
| Harmonic Security | Partly described | Deployment options include desktop apps and AI agents, rolled out through device management; the on-device component is not described in detail. | Source: Harmonic Security pricing (re-read) · Read 11 Oct 2026 |
| Koi (Palo Alto Networks) | Described | Agent-based visibility into models, MCPs and extensions, one-click removal of insecure packages, extensions and AI tools, and blocking of unsafe AI application interactions. | Source: Palo Alto Networks: Cortex Agentic Endpoint Security · Read 27 Sep 2026 |
| Lasso Security | Partly described | Connects directly to Claude Code's lifecycle hooks via the enterprise management platform and inspects every tool call before it runs; a resident device agent is not described. | Source: Lasso Security: AI coding assistants · Read 27 Sep 2026 |
| Neo | Described | A live inventory of agents, models, skills, MCP servers and extensions on every endpoint, with runtime control that intercepts agent actions. | Source: Neo homepage · Read 13 Oct 2026 |
| Noma Security | Described | Discovers endpoint agents such as Claude Code, Cursor and Codex with their MCP servers and skills, blocks unauthorized and malicious ones, and inspects activity at runtime. | Source: Noma Security: endpoint agents · Read 27 Sep 2026 |
| Onyx Security | Described | Endpoint agents cover coding assistants and desktop AI agents. | Source: Onyx Security: AI security platform · Read 27 Sep 2026 |
| Pluto Security | Partly described | (secondary: SACR) inline hook configuration on coding agents for runtime observability and enforcement. | Source: SACR (secondary): CISO guide to endpoint control and prevention, July 2026 · Read 13 Oct 2026 · secondary source |
| Prompt Security (SentinelOne) | Described | A dedicated AI endpoint agent detects new AI agents, skills and connectors and applies runtime policies; it names GitHub Copilot, Cursor and Claude Code among the code assistants it inventories. | Source: Prompt Security blog: browser and endpoint sensors · Read 11 Oct 2026 |
| Sun Security | Partly described | Covers agents on workstations; the on-device method is not described. | Source: Sun Security homepage · Read 13 Oct 2026 |
| Zenity | Partly described | Blocks or modifies a dangerous tool call before it executes through native agent hooks; how it reaches endpoints is not detailed. | Source: Zenity: coding and personal agents · Read 27 Sep 2026 |
| Zscaler Generative AI Security | Not in our sources | Not described on the pages we read. | None |
Not in our sources is not a no. Ask the vendor, and send us a public source if one exists.
The products that describe on-device control reach the device in different ways. Bay and Noma Security state that they work through existing EDR or MDM without a new agent. Koi (Palo Alto Networks) is agent-based and is also offered as a Cortex XDR module. Onyx Security uses its own endpoint agents, and Prompt Security (SentinelOne) uses a dedicated AI endpoint agent alongside a browser extension, arguing that EDR or MDM integrations are not enough. Several others describe part of the job: Zenity and Lasso Security act through agent hooks, Harmonic Security rolls out through device management, Akamai Workforce Protector says its controls reach desktop applications, and Bloom Security describes discovery without saying how it reaches the device.
What should you ask?
- How does the product reach the device: its own agent, a binary pushed through our EDR or device management, or hooks inside the AI agent?
- Which AI agents and coding assistants does it recognise today, and how long does a newly installed agent take to appear?
- Can it decide on an individual tool call before it runs, and can it ask the user rather than only block?
- What does a developer see when an action is blocked or paused, and how do they ask for an exception?
- Does the record show whether a person or an agent took each action?
Sources
Source: MCP Security Best Practices (2026-07-28) · Read 27 Sep 2026
Source: Bay homepage · Read 27 Sep 2026
Source: Noma Security: endpoint agents · Read 27 Sep 2026
Source: Lasso Security: AI coding assistants · Read 27 Sep 2026
Source: Palo Alto Networks: Cortex Agentic Endpoint Security · Read 27 Sep 2026
Source: Onyx Security: AI security platform · Read 27 Sep 2026
Source: Prompt Security blog: browser and endpoint sensors · Read 11 Oct 2026
Source: Akamai Workforce Protector (formerly LayerX) · Read 11 Oct 2026
Learn more
- Browser AI, desktop agents and coding agents: three different risks
The first question in the finder is which AI tools people use. The answer changes everything after it.
- Rolling out AI controls to developers without stopping their work
Developers are the heaviest users of AI agents and the quickest to route around a control that gets in their way.