Agentic Endpoint Posture
Employees install agents that spin up Model Context Protocol (MCP) servers, skills, and hooks. Those components read files, reach databases, and run shell commands. Island finds every one of them, scores it, and governs them by policy.
The world’s leading enterprises run on Island.
.png)
.png)
.png)
.png)
.png)
How attackers target AI skills and MCP servers
Read the report
7,600
Malicious GitHub repositories in a single campaign
600+
Registry listings for its fake AI skills and MCP servers
62%
Of its fake skills and MCP servers aimed at enterprise or developer work
3 of 3
AI assistants Island tested found a malicious repository on their own
Endpoint tools were built for a different problem
Most endpoints in the enterprise now run AI. Most security teams cannot see any of it.
Today's security stack looks past AI
Endpoint detection and response (EDR) catches executables and signatures while network security tools are limited to traffic on the wire. AI assets are scripts, configs, and prompts that remain largely invisible to these solutions.
Shadow AI and MCP servers are invisible
Security teams cannot list the MCP servers, AI clients, skills, and hooks running on their own fleet, and they cannot say what each one interacts with.
A file read looks like a file read
Agents run with the user's own credentials. A database query or a shell command looks identical whether the person ran it or an agent ran it on their behalf.
The supply chain underneath is unvetted
Island scanned 33,563 public MCP servers covering 475,865 tools. Nearly half returned at least one security finding. More than a third carried a high or critical one.
How it works
Island Agentic Endpoint Posture sees, scores, and governs MCP servers, skills, and hooks
See it
A live inventory of every AI asset on every device. MCP servers, both configured and actively listening. AI clients such as Claude, ChatGPT, and Cursor. Skills, hooks, code packages, and IDE and browser extensions.
Score it
One score per asset, split into impact and likelihood, with the findings behind it written in plain language. The analyzers run in the cloud and are maintained by Island's security research team.
Act on it
Govern assets based on policy. Control access based on risk thresholds, allow-list sanctioned AI clients, remove or update a risky component, or revert a dangerous setting back to a safe state.
Continuous risk scoring of all AI assets
Agentic Endpoint Posture uses multiple methods to assess AI assets. New detectors ship from the cloud without a client update.
- Static code analysis on every asset, with publisher and project trust checks
- CVE records connected to real exploitability
- Secrets found sitting in plaintext inside configuration files
- Hidden characters caught before they smuggle instructions past human review
Act instantly when risk is identified
Enforcement happens the instant risk is identified, not on a scheduled scan.
- Identify risks associated with AI assets
- Govern which AI clients users can use and how they can use them
- Force users to log into their corporate agentic AI account, not personal accounts
- Restrict access to skills, MCP servers, and other assets above a defined risk threshold
Instant visibility into what is installed and what is popular
Agentic Endpoint Posture gives you visibility into every AI asset installed in your fleet, while Island scans public marketplaces to identify commonly used and risky assets.
From the fleet
Understand what is installed, what is listening, what it can reach, and which device it sits on.
From the marketplace
See what the wider population of public MCP servers and packages looks like, and how the asset on your endpoint compares.
One query investigations
Easily query your devices. When a malicious package hits the news, see if it is in your environment in seconds, not days.
Governing the entire agentic lifecycle
Agentic Endpoint Posture, Agentic Identity, and AI Runtime Protection work together to govern the agent lifecycle, from prompt and resources to actions and responses.
FAQ
A component of the Island Enterprise Agentic Control Plane that inventories every AI asset on every managed device, sanctioned or shadow, scores each one for risk, and enforces policy on the ones that breach it. AI assets include MCP servers, AI clients, skills, hooks, code packages, IDE extensions, and browser extensions.
Shadow AI is any AI tool, agent, or component running in the organization without the security team's knowledge or approval. On the endpoint, it includes the MCP servers an employee configured in an AI client, the skills a coding agent pulled down, hooks, local model runtimes, and AI-capable browser and IDE extensions. Much of this activity never crosses the network, so network tools miss it, and EDR tools built for executables pass over scripts and configuration files. Agentic Endpoint Posture inventories each of these components on every managed device, scores it for risk, and applies policy to the ones that breach it.
Run one query. Agentic Endpoint Posture reads the MCP server definitions in supported AI clients and coding agents, detects servers that are actively listening, and lists each one with the tools, prompts, and resources it exposes and the device it runs on. The inventory covers local servers that run over standard input and output (stdio) as well as remote servers. When a malicious package hits the news, the same query shows which devices have it in seconds.
EDR catches executables and signatures. AI assets are scripts, configuration files, and prompts, so they pass through unflagged, and much of what they do never touches the network. Where EDR does see an action, it cannot say who took it, because MCP servers run under the user's own credentials. Agentic Endpoint Posture inventories the AI assets themselves and scores each one. On devices without Island Desktop, it collects through a supported EDR platform, so the two work together.
It builds a live inventory of the AI assets on every device: MCP servers, both configured and actively listening, AI clients such as Claude, ChatGPT, and Cursor, AI skills, AI hooks, code packages from npm and Python, IDE extensions, and browser extensions.
Not from the raw action alone. MCP servers act with the user's own credentials, so the raw action looks identical either way. The inventory shows which MCP servers are present on the device and what each one reaches, which lets security attribute the action rather than guess at it.
Yes. Each asset gets a risk score split into impact and likelihood, calculated from static code analysis, publisher and project trust, CVE records weighed against real exploitability, secrets found in configuration files, and hidden characters used to smuggle instructions past human review. Every finding appears in plain language underneath the score.
Yes. Agentic Endpoint Posture is built on Device Query, Island's query-anything engine, so you are never limited to the AI inventories it ships. Ask any question of the device, AI or not: TLS certificates, disk encryption, running processes, startup items. It also replaces a standalone device query tool.
Agentic Endpoint Posture recognizes AI desktop clients, coding assistants, and command-line interface (CLI) tools on managed devices, including Claude Desktop, Claude Code, Claude Cowork, the ChatGPT desktop app, Codex CLI, the Microsoft 365 Copilot app, Cursor, Gemini CLI, and GitHub Copilot. It also inventories AI-capable browser extensions and integrated development environment (IDE) extensions. For each one, Island records the publisher, the version, and the permission scope whenever that metadata is available.
It discovers local model runtimes such as Ollama and LM Studio. The inventory covers the configuration that shapes how agents behave: Model Context Protocol (MCP) server definitions, including local servers that run over standard input and output (stdio), along with hooks, skills, plugins, and the prompt and configuration files of supported agents.
.png)
.svg)
.svg)
