Every endpoint in the enterprise now runs AI. Employees install agents that spin up MCP servers, skills, and hooks, and those components can read files, reach databases, and run shell commands. Most security teams cannot see any of it.

The tools built to watch the endpoint were built for a different kind of software. EDR catches executables and signatures. This new AI ecosystem is scripts, configs, and prompts, not compiled binaries, so EDR looks straight past it. And where EDR does see an action, it still cannot tell you who really took it: MCP servers run with the user's own credentials, so a file read, a database query, or a shell command can look identical whether the person did it or an MCP acting on their behalf. A lot of the activity never crosses the network either, which leaves network tools blind to it too.

With Island Agentic Endpoint Posture you close that gap. You get a live inventory of every AI asset on every device, a risk score for each one with the evidence behind it, and a path to act on that risk where it lives.

The challenge: AI moved onto the device faster than security could follow

Shadow AI on the endpoint is the fastest-growing blind spot in the enterprise. The pattern repeats across organizations. Leadership tells everyone to adopt AI. The security team gets a couple of months to make it safe. By the time anyone looks, nobody can say what is actually running on the machines.

MCP servers are the sharpest edge of the problem. They run with the user's own credentials, and they get installed without review. Security has no record of what they can reach, which ones are holding plaintext tokens in a config file, or whether a given action came from the person at the keyboard or the MCP acting on their behalf.

The visibility tools already in place cannot fill the gap. Skills, hooks, MCP configs, and code packages are files and configs, not executables, so endpoint detection built for binaries never registers them. Some of this activity runs entirely on the device and never touches the wire, so network inspection cannot catch it either.

Speed is the other half of the problem. When a malicious package hits the news, the question is simple: are we affected? Answering it by hand takes days. By then the answer no longer matters.

Our approach: one console, already on the device

For existing Island customers, Agentic Endpoint Posture runs on Island Desktop, so no additional installation is needed. For everyone else, it deploys agentless through the MDM or EDR tool your organization already uses for managed devices. Either way, the visibility, the risk scoring, and the action all work from the console the team already uses.

It is built on three pillars, in order: visibility, risk, and enforcement. Everything it ships slots into one of them.

‍

How it works

Two vantage points feed one risk picture. Agentic Endpoint Posture collects from the fleet of devices, and it scans the public marketplaces where AI components come from. Both streams flow to a set of analyzers that score every asset, and the result lands in one console.

Visibility, see the local AI no network tool can

Local AI is the part the network completely misses. A local MCP server talking over stdio never crosses the wire. A hook that fires on a file save produces no network traffic. A skill sitting in a folder, a model running locally, a background process: none of it shows up on the network. Agentic Endpoint Posture sees all of it, because it lives on the device.

The inventory is the proof behind the whole story. It is the live list of AI assets collected from every device.

MCP coverage goes deep. Agentic Endpoint Posture separates the servers that are configured from the ones actually listening, and for a running server it shows the tools, prompts, and resources it exposes. That is the difference between knowing an MCP exists and knowing what it can do.

Risk: a score, and the reason for it

Risk is never a single number with no story. For each asset, Agentic Endpoint Posture shows an overall risk, split into impact and likelihood, then the detail behind it: the findings, the risky behaviors, the misconfigurations, the known vulnerabilities. An admin sees not just High, but exactly what drove the score, in plain language.

The scoring runs in the cloud, owned by Island's security research team. The analyzers do static code analysis, check publisher and project trust, connect known CVEs and their real exploitability, find secrets sitting in configs, and catch hidden characters used to smuggle instructions past human review. New detectors ship without waiting on an endpoint release, so the whole picture rescores as the research improves.

Enforcement: acts the instant risk crosses the line

Enforcement fires the instant risk crosses your line, not on the next scheduled scan. Set the policy once: block an asset above a risk threshold, allow-list the AI clients you sanction, remove or update a risky component, lock a dangerous setting back to a safe state. From there, Agentic Endpoint Posture watches every device in real time and enforces automatically the moment a match appears. See it, score it, act on it, all from one console, without waiting for anyone to notice.

Where it fits: posture and protection, together

Agentic Endpoint Posture and AI Protect solve two different halves of AI security. Agentic Endpoint Posture looks at the AI assets themselves: the MCP servers, skills, hooks, and packages on a device, including the local ones that never touch the network, and how risky each one is. AI Protect looks at what the AI actually does: the prompts, responses, tool calls, and MCP responses moving through the workspace, inspected inline and in the clear. One scores the artifact. The other reads the interaction. Point tools only get one of these views. A tool built for the network sees traffic, not what happens on the device. A tool built for the endpoint sees the process, not what crossed the wire. Island runs both from one platform, so nothing here depends on a single vantage point holding the whole picture.

The two solutions share more than a console. The risk scores Agentic Endpoint Posture produces become threat intelligence that AI Protect reads at the point of use. When AI Protect sees an MCP server in play, it can ask whether that server is safe and get an answer grounded in the posture already scored on the device. Island's work here extends the Claude Compliance API integration, adding the device-side view that server-side capture alone cannot reach.

What this changes

The security team can answer the board with data instead of guesses. They can surface every MCP server on the fleet, see exactly what it can reach, and know whether credentials are sitting exposed in its config. When a malicious package hits the news, one query shows which devices have it, in seconds rather than days. And the organization moves from blanket bans to a real governance program: discover, assess, sanction.

The moment that lands hardest is the first look. Connect to a tenant, run one query, and the fleet's AI footprint appears: every MCP server, with risk scores and findings. Open one, and there are the secrets, sitting in plaintext. Almost every team sees something they did not know was there.

Island's threat research team put the analyzers behind Agentic Endpoint Posture to the test against the public MCP ecosystem: 33,563 servers pulled from npm, PyPI, and remote-server registries, covering 475,865 tools in total. Nearly half returned a security finding. More than a third carried a finding at high or critical severity. The analyzers catch real attacks already seen in the wild, including a trusted npm package that silently BCC'd corporate emails to an attacker-controlled domain after fifteen clean releases, a marketing-analytics tool whose response quietly instructed agents to log every conversation without telling the user, and servers binding to every network interface with authentication explicitly disabled.

The detection engine behind that research is the same one scoring the MCP servers on your own fleet. Read the full findings.

Conclusion

Enterprises adopted AI on the endpoint faster than anyone could secure it, and the tools already in place were built for a world of executables and network traffic, not scripts, configs, and local agents. That gap is where the risk lives now.

Agentic Endpoint Posture closes it. A live inventory of every AI asset on every device, including the local activity no network tool can see. A risk score for each one, with the evidence behind it. The ability to act on that risk in real time, where it lives. No new agent to deploy, one console that covers the whole device, and paired with AI Protect, both the assets and the interactions governed from one control plane. As agents move more of their work onto the device, that position only becomes more valuable. When the board or the regulator asks what your agents can reach and what they have done, the answer starts here. Island is already there.

See what's running on your own fleet. Talk to Island to get a demo of how Agentic Endpoint Posture on your devices.

‍

FAQs

What does Agentic Endpoint Posture discover?

It builds a live inventory of the AI assets on every device: MCP servers, both configured and actively listening, AI clients such as Claude, ChatGPT, and Cursor, AI skills, AI hooks, code packages from npm and Python, IDE extensions, and browser extensions.

Do I need to deploy a new agent?

Not if you already run Island Desktop. And if you don't, Agentic Endpoint Posture deploys agentless through your existing MDM or EDR, so there is no new agent either way.

How is risk scored?

Island's security research team owns a set of analyzers that run in the cloud. They perform static code analysis, check publisher and project trust, connect known CVEs and their exploitability, find secrets in configs, and detect hidden characters used to smuggle in instructions. Each asset gets one overall score, split into impact and likelihood, with plain-language findings behind it.

What about AI running in the browser?

The browser is covered by AI Protect and Island's browser layer, which inspect AI traffic in the clear at the point of use. Agentic Endpoint Posture focuses on what runs on the device itself. Together they cover both surfaces.

How is this different from EDR?

EDR was built to catch executables and signatures. AI assets are files, configs, and prompts, not compiled binaries, so EDR does not register them. Agentic Endpoint Posture is built for exactly this class of software, and it also sees local AI activity that never touches the network.

Can you tell whether an action came from a user or an AI agent?

‍Yes. MCP servers act with the user's own credentials, so a file read, a database query, or a shell command can look identical whether the person did it or an MCP did it on their behalf. Agentic Endpoint Posture's inventory shows which MCPs are present and what they can reach, so security can attribute the action instead of guessing.

Can I use the Agentic Endpoint Posture to query more than just AI on the device?

‍Yes. Agentic Endpoint Posture is built on Device Query, Island's query-anything engine, so you are never limited to the AI inventories it ships. Ask any question of the device, AI or not: TLS certificates, disk encryption, running processes, startup items. AI is the reason to open it every morning. Everything else is the reason to never open another tool.