LogSentra
Request a demo
AI Agent Security · Detection and blocking on the endpoint

See what every AI agent does. And stop it before it happens.

LogSentra discovers Claude Code, Codex and their MCP servers across your machines, turns their activity into evidence you can investigate, and — where it is still possible to say no — denies the call inside the agent itself, before it runs. Without capturing content by default.

Request a demo See how it works
  • Self-hosted
  • Metadata-first
  • Blocks without network

telemetry.flow / endpoint-demo

online

Local sources

C
Claude Codesession.jsonl
⌘
Codexsessions/*.jsonl
M
MCP configglobal + project
LogSentra Agent local · unprivileged
01 Detect
02 Decide
03 Queue

Control plane

Inventoryagents · tools · MCP
Findingrisk.signal / high
Evidencehash · time · context
Allowed Observed Review

Illustrative event

Native coverage
C Claude Code
⌘ Codex
01 The blind spot

Your EDR sees the process. Your SIEM sees the network.
Neither understands the session.

A coding agent can read repositories, invoke tools and operate with valid credentials. To the traditional stack, that activity looks like a developer doing their job.

EDR

A known process

node · python · shell

It sees execution on the endpoint, but not the agent's intent or context.

Blind spot
tool_call mcp.github.create_pr which agent? · which MCP? · authorised?
SIEM / NDR

Legitimate traffic

api.github.com · 200

It sees events and connections, but loses the agent–tool–MCP graph.

LogSentra adds the missing context between the local session and the SOC investigation.

Explore the flow →
02 What it solves

From unknown assets to a call that never runs.

Detection over what already happened and a decision about what is about to, in the same console.

01

Discover agents and MCP

Inventories installed sources, global and per-project MCP configuration, and how each relates to an endpoint.

02

Reconstruct the activity

Normalises sessions, tool calls, paths, models and servers to answer what happened and where.

  • Searchable sessions
  • Real tool usage
  • Time traceability
03

Detect risk signals

Applies deterministic detectors and editable rules to sensitive behaviour, with signals an analyst can explain.

  • Unsanctioned MCP
  • Sensitive paths
  • Dangerous context
04

Deny it before it happens

A hook inside the agent itself receives every tool call before it runs, and decides. No network, no waiting for the next collection: it is the only place where saying no is still possible. The median decision takes 10 ms, against the seconds a model takes to answer.

05

Ask a person

What is neither clearly good nor clearly bad gets held and asked about. The agent waits; whoever decides does it from the console, or from wherever the notification reached them.

  • Bounded window
  • "Do not ask again"
  • A timeout is never a silent denial
06

Tell somebody outside the console

An alert at three in the morning is worth nothing if nobody sees it. Signed deliveries to Slack, Teams, Discord or your SIEM, with retries and a delivery log.

  • HMAC-SHA256 per delivery
  • New finding and waiting approval
  • Devices that stop reporting
07

Run the fleet and the policy

Health, version and automatic updates per device. Rules scoped by department with exceptions per machine — because "everywhere except the three build servers" is a sentence people actually say.

03 How it works

Three moves. One chain of evidence.

The decision happens where the signal lives: on the endpoint. The platform centralises the context without opening an inbound port.

Turns scattered files into one inventory.

The agent combines endpoint discovery and session parsers to identify sources, MCP servers and verifiable activity.

  • Claude Code and Codex on by default
  • Global and per-project MCP
  • Stable fingerprint per asset

logsentra-agent discover

$ logsentra sources

SCANNING  /Users/user/.claude
FOUND     claude_code 2.1.14
FOUND     codex 0.118.0
MCP       github project
MCP       filesystem global

snapshot  8be4…91fd  ✓ queued
EndpointmacOS · Linux · Windowsmachine-wide service
TransportOutbound HTTPSBearer per device
PlatformDocker ComposeGo · Postgres · React
04 Privacy by architecture

Security does not require keeping every conversation.

LogSentra separates operational signal from content. The policy is applied locally before sending, and the most restrictive mode is the default.

01

Minimised at sourcePrompt, code, patches, stdin and results are replaced by hash and length.

02

Validated on the serverA payload richer than the declared policy is rejected, even if the agent is tampered with.

03

Exceptional, audited accessContent requires the auditor role, and every read is recorded.

data.policy / preview

on-device
01{
02 "tool": "Read",
03 "path": "src/auth/policy.py",
04 "prompt": { "hash": "a91f…", "length": 84 },
05 "timestamp": "2026-09-04T14:22:08Z"
06}
Content in custody0%

Prompts, code and results never leave the endpoint.

Policy validatedprofile: metadata · v4
05 Fits your architecture

Complements your stack. It does not try to replace it.

LogSentra covers the context specific to agents and MCP without duplicating what the endpoint or the network already do.

C

Claude CodeLocal sessions

⌘

CodexLocal sessions

M

Global MCPConfiguration

P

Project MCPConfiguration

LogSentracontext layer

Slack · Teams · DiscordSigned notification

SIEM / webhookRaw event

Console / APIOperations and evidence

06 Enterprise operations

Control for Security. Minimum friction for Engineering.

A light agent, no inbound privileges and no open ports. One central console to know what exists, what happened, and what never got to happen.

Fleet

Visible healthHeartbeat, version, sources, pending queue and an alert when a device stops reporting.

RBAC

Separation of dutiesAdmin, analyst and auditor, with explicit access to content.

Queue

Resilient deliveryEncrypted local queue, backoff and end-to-end idempotency.

Policy

Scope and exceptionsRules per department, with per-machine exceptions and the reason beside them.

Fleet overviewIllustrative data

Last 15 min ⌄
HealthOnlinevisible
PolicySyncedversioned
Local queueEncryptedat rest
EndpointSourcesPolicyStatus
demo-mac-01macOS · arm64C⌘metadata · v4Healthy
demo-win-02Windows · x64C⌘metadata · v4Healthy
demo-mac-03macOS · arm64Cmetadata · v3Degraded
demo-linux-04Linux · x64⌘redacted · v4Healthy
Status derived from heartbeatPolicy and sources visible
07 Frequently asked

The essentials before deploying.

Direct answers for Security, Platform and AI governance owners.

Does LogSentra read prompt content?

Not by default. In metadata mode, prompts, code, patches, stdin and results are replaced locally by hash and length. Richer modes require an explicit decision.

Does it block, or only observe?

Both, in different places. Detection runs on the platform over what has already been collected. Blocking runs on the device, inside the agent's hook, before the call executes — and keeps working with the server down. A rule can allow, hold and ask, or deny.

What sources does it analyse?

Claude Code and Codex sessions, global and per-project MCP configuration, the machine's processes, and the network connections the agents open.

How is it deployed?

The platform is self-hosted with Docker Compose. The agent runs as a machine-wide service on macOS, Linux and Windows, covers everybody who uses that device, and only needs outbound HTTPS.

How does anybody find out what happened?

Through the console, and outside it. An outgoing destination receives the new finding, the approval request somebody is waiting on, and the device that went quiet — signed with HMAC-SHA256 and retried.

Technical demo

Start by answering one question:
which agents are acting today?

Request a 30-minute technical session. We will go through sources, endpoints, privacy, blocking and deployment architecture.

  • Coverage map
  • Deployment architecture
  • Operating criteria
Request a demoReply from the team