Frequently Asked Questions About Agentic Endpoint Posture

Does Agentic Endpoint Posture show how agents, MCP servers, and tools connect?

Yes. For supported agents, the inventory maps each agent to the MCP servers it has configured and the tools those servers expose. Every record lists the application, its category, the users observed with it, the control point that reported it, the agent configuration, and its risk information.

How does Island discover shadow AI across the organization?

Island discovers sanctioned and unsanctioned AI through several sources at once: browser activity, routed network traffic, the Island MCP Gateway, AI provider integrations, telemetry, and local collection. The endpoint inventory joins that picture, so Island can tie a coding agent found on a laptop to the MCP traffic it sends through the gateway and the requests it makes over the network. Each source runs on its own collection schedule.

What does Agentic Endpoint Posture check in a coding agent's configuration?

For supported coding agents and desktop AI clients, it reads the permission mode along with the MCP server, hook, and skill configuration, then reports the settings that are risky or missing. Posture views show each agent's current configuration next to those findings, so a security team can spot agents running with broad permissions.

How does Island check MCP servers, skills, and plugins for hidden instructions?

Island scans the available metadata of MCP servers, including tool descriptions, along with skills, plugins, and hooks, and flags malicious or hidden instructions before that content reaches an agent through an Island inspection path. Indicators from Island's security research identify known malicious skills and MCP servers. The same research covers AI applications and attack techniques, and its findings feed new detection content into the scans.

What else does Island score besides installed assets?

Island scores the posture of each supported agent installation on the endpoint, and it separately scores the risk of the AI applications it observes in use. Island adds threat intelligence on known malicious or risky MCP servers, AI applications, and attack campaigns.

Do I need to install anything new to run Agentic Endpoint Posture?

No. Island collects endpoint data in two ways. On devices that already run Island Desktop, Agentic Endpoint Posture uses Device Query, the osquery-based engine built into Island Desktop that runs live and scheduled queries, so nothing new gets installed. On other managed devices, Island collects through a supported endpoint detection and response (EDR) platform, and supported mobile device management (MDM) tools handle deployment and inventory.

What happens after Island finds an unapproved MCP server?

Island acts at the points where an agent actually calls the server. For supported agents with a pre-tool hook, Island can deny a call to a local MCP server before it runs. For remote servers, the MCP Gateway admits only the servers on the administrator's approved list and denies routed connections to anything else by default. Policy can also restrict access to any skill, MCP server, or other asset above a defined risk threshold.

How can teams report on the inventory or export it?

Posture dashboards and scheduled reports track the state of AI assets across the fleet for security and executive audiences. The inventory and the usage data behind it are available in the Island Management Console and through application programming interfaces (APIs), and posture findings export for mapping to the frameworks a governance team reports against. Teams that run a configuration management database (CMDB) can build a sync on the same APIs.