AI agents run in agent harnesses on every developer and employee desktop in your organization. These agents integrate models with production data, APIs, and endpoints while running outside of existing governance controls. Agentdesktop brings visibility, security, and control to agents where they actually run - on the desktop.
| Device | Detected tool | Configuration | Gateway |
|---|---|---|---|
| ENG-042agentdesktop active | Claude Code | Revision 12 | Connected |
| FIN-018agentdesktop active | OpenCode | Revision 12 | Connected |
| ENG-107agentdesktop active | Codex | Revision 12 | Connected |
of employees run unapproved AI tools at work. [1]
Every laptop is quietly accumulating agent harnesses, MCP servers, and skills that no inventory captures. The first step analysts recommend for agent governance: build the inventory.
hardcoded secrets leaked on GitHub in 2026. [2]
Agents authenticate with long-lived API keys sitting in plaintext config files — the exact credentials harvested at scale when supply-chain attacks weaponized AI tools on developer laptops.
of enterprises don’t enforce AI identity policies. [3]
Every harness has its own settings format, its own admin console, its own drift. Policy you set once should hold everywhere — on every device, in every tool, continuously reconciled.
An agent inventory, managed policy, non-human identity, and end-to-end observability — delivered by one daemon on the device and one controller for the fleet.
Device inventory
Build the agent inventory security frameworks now call for: every harness, version, MCP server, and skill across the fleet, attributed to a device and its signed-in user. Surface shadow AI without reading secrets — no command arguments, environment variables, headers, or skill bodies.
A daemon on each device, a controller for the fleet, and a trust chain to your inference gateway.
A single declarative config manages the gateway connection, telemetry, and per-tool policy — reconciled into Claude Code, Claude Desktop, Codex, and OpenCode in their own formats.
Pairs with agentgateway — or any inference gateway that verifies JWTs.
inferenceGateway:
url: https://gateway.example.com
authentication:
type: controllerJwt
audience: agentgateway
telemetry:
events: [session.new, tool.use]
programs:
claudeCode:
permissions:
defaultMode: plan
claudeDesktop: {}
codex: {}Keep configuration local. Preview and apply changes from YAML without a controller or device identity, and authenticate directly to your gateway.
Enroll devices and let the controller distribute versioned configuration. It also issues short-lived gateway JWTs and records fleet state for the management UI.