Overview
The question most organisations cannot answer about themselves, and how measuring from the endpoint answers it.
On this page
endlayer answers a question most organisations cannot currently answer about themselves: which AI tools are running on our machines, how are they configured, what are they costing, and does any of that match what we said our policy was.
AI tooling arrives through people rather than through procurement. Somebody installs an agent because it makes their week easier, points it at a repository, gives it a credential for an internal service, and none of that appears in an application inventory, a licence report, or a purchase order.
It is answered from the endpoint
An unprivileged agent runs as the person whose machine it is. It reads what AI tooling is installed and how it is set up, and reports a bounded, versioned snapshot to a backend you control. Nothing is executed, nothing is elevated, and the content of anybody's work stays on the device unless somebody with the authority to decide otherwise turns it on deliberately.
Managed estate
What is measured
Control plane
Your deployment
Governance outcomes
What people do with it
The only instruction that travels back to a device is its configuration — what to collect, and whether to pause. Enforcement across layers is planned, not built.
implemented todayplanned, not built
What it measures
Twenty-one signals per scan, in six groups.
| Group | The question it answers |
|---|---|
| Tools and agents | What is installed, and can it act without asking? |
| Apps and web | Which AI services are being used, and is the blocklist real? |
| MCP and access | What has an agent been given access to? |
| Projects and data | Which repositories is this happening in, and is a key exposed? |
| Usage and cost | Which models, how many tokens, attributed to whom? |
| Endpoint posture | Is the machine doing this on a sound footing? |
The tools recognised today include Claude Code, Claude Desktop, Codex CLI, ChatGPT Desktop, Cursor, Windsurf, GitHub Copilot, Aider, Goose, Gemini CLI, Grok Bot, Grok Build, Cline, Continue, Ollama and LM Studio — with browser AI usage per profile, and MCP declarations across every client that keeps them in a file.
What it does with the measurement
Facts and verdicts are separated on purpose. The agent reports facts — that a permission-skipping mode is the configured default, or that fourteen domains on your required list are not blocked. It does not say whether that is acceptable, because it has no way to know your policy and a device is the wrong place to keep one.
The backend grades those facts against your policy, and grades conservatively: a measurement the
device could not take stays unknown rather than being scored, and a control with no policy behind it
comes out ungraded, never pass. An empty allowlist means "nobody has said yet", not "nothing is
allowed".
The console shows both, with the evidence behind every verdict and the history of when it changed.
Where to go next
Three parts, one network seam, and what a scan actually costs a laptop.
What is collectedEvery signal and its privacy boundary — the page a security review starts on.
Trust modelThe seven promises that are structural rather than configurable.
DeploymentOne machine, or a fleet with no human at any of them.