Coming soon
Know the AI at work.
AgentShield shows security and IT teams the AI agents at work on their Macs — which tools are running, what they reach and where they connect — from system-level evidence, not an app name.
For security & IT teams
Make informed decisions about AI at work.
Your people are adopting AI. AgentShield gives your team the context to understand that use, investigate unexpected activity and decide where safeguards belong.
- Understand AI adoption
- See recognised tools and AI-like activity on monitored devices. Compare what is running with the tools your organisation has approved.
- Investigate unexpected activity
- Follow an agent’s files, commands and connections in context. Give your team a concrete starting point when something needs a closer look.
- Decide where boundaries belong
- Use the observed activity to review access and shape safeguards around real workflows. The current engine provides visibility; enforcement is in development.
AgentShield observes AI activity at system level, grouping an assistant and its helpers into one agent. Your team can review file activity, commands and model connections together, without adding an SDK to each tool.
Understand the activity
What AgentShield sees.What your team can do.
See the files an agent reaches, the helpers it launches and the model services it contacts — together with the evidence behind that view. Choose an example to see what your team could investigate.
Illustrative examples · not a live product interface
What is detected
One assistant. A clearer view of its activity.
The assistant, its shell, helper and language server are grouped into one agent, so your team can review their activity together.
Observed activity
Runs commands and helpers
The assistant launches a shell and a helper to run build commands.
Reads project files
A file read matches a sensitive-data pattern. The check records a category and a hash, never the text.
Connects to a hosted model
DNS and TLS metadata show a connection to a model API.
What your team can do
Check that the assistant is approved for this project. Review whether its file access, commands and model connection match its task, then decide whether access or configuration needs to change.
Evidence behind the example
The signing identity and process name match a recognised coding assistant. Behaviour, content checks and network evidence add context to that identity.
Confidence reflects which kinds of evidence agree. It is not a threat score or a judgement about the assistant’s intent.
What is detected
AI-like activity, without a recognised name.
A local model server has no known identity to match. Its behaviour and network activity still give your team a lead to investigate.
Observed activity
Loads a model runtime
An AI framework is loaded in memory, with memory use at the scale of a model.
Listens for requests
The process opens a listening port on the device.
Handles local model traffic
Traffic on that port has the protocol shape of model requests.
What your team can do
Identify who is using the runtime and why. Confirm whether it belongs on the device and review unexpected connections before deciding on a response.
Evidence behind the example
No signing identity or process name matches a known tool. Behaviour and network evidence support surfacing the activity for review.
Content checks are not applied until an agent is identified. This is a lead, not proof of an attack or a promise to recognise every AI tool.
Examples, not recordings. AgentShield is in development. The current engine observes and classifies; it does not block actions.
Identity
Reads Signing identity, process names, the environment an agent runs in and the configuration files it carries — the quickest way to recognise a tool you already know about. It is read together with the other three.
Never keeps The values of environment variables. Redaction happens at compile time.
Behaviour
Reads What the process does: AI frameworks loaded in memory, memory use at the scale of a loaded model, ports it listens on, helpers it spawns, commands it runs — and whether the machine’s keyboard and mouse are being driven by automation rather than a person. This is how activity with no recognised name can still come into view.
Never keeps Keystrokes. Automation detection counts input events; it does not read what was typed.
Content checks
Reads Pattern checks on selected local material an identified agent reads, writes or copies — enough to say which categories of material it handled.
Never keeps The material itself. A check outputs a category and a hash, never the text.
Network
Reads DNS, TLS metadata and the protocol shape of local model traffic — which is how a model call looks different from a web page.
Never keeps Request bodies. Local model traffic is inspected for shape inside the network extension and does not leave it.
Agent recognition
A name is a starting point. Behaviour adds context.
AgentShield combines recognition of known AI tools with evidence of how processes behave. This helps your team understand familiar tools and investigate activity that does not match a known name.
Recognise known AI tools
Where an identity is recognised, AgentShield can associate activity with a tool name. Your team can connect that identity to what the agent does and compare its use with the tools approved for your business.
Look beyond the name
Behaviour and network evidence can surface unfamiliar AI-like activity for review. Your team gets a lead to investigate even when a process does not match a known tool; an unfamiliar name alone does not decide what is visible.
Check recognition in your environment
An evaluation would use your tools and everyday workflows to establish what AgentShield can identify. Results depend on versions and configuration, so we do not promise detection of every AI tool.
The agent, over time
Spot changes in an agent’s activity.
An agent’s activity can change as its task develops. These examples show how AgentShield connects shared resources, new capabilities and changes in behaviour to questions your team can investigate.
Shared resources
Two agents use the same tool server.
Shared tools and connected file activity help reveal relationships between agents. Your team can review the shared resource with both agents in view.
A question for your teamShould both agents have access to this shared resource?
New capabilities
A file-reading assistant starts running commands.
AgentShield surfaces a new category of activity, such as command execution or external connections, so your team can review what changed.
A question for your teamDoes the new capability belong to the task you approved?
Changed behaviour
A local model server starts connecting to a hosted API.
A new connection can depart from the agent’s observed pattern. The comparison uses activity in the current run, with a baseline held in memory.
A question for your teamIs this connection expected, or does the configuration need a closer look?
A change is a reason to investigate, not proof of an attack.
Privacy by design
Understand the agent. Limit what you collect.
Core analysis happens on the device. Collection rules limit what is recorded, while optional model-assisted analysis stays off until your team enables it.
Local analysis & collection
- Analysed locally
The engine identifies AI agents using identity, behaviour, content checks and network evidence on the device.
- Recorded selectively
- IdentityEnvironment-variable values are not recorded.
- BehaviourInput events are counted. Keystrokes are not read.
- ContentCategories and hashes are kept, not the source text.
- NetworkLocal model traffic bodies stay inside the network extension.
- Changes to the log can be detected
Detection records are linked by hashes, so the log can reveal when a record has been altered.
This makes the log tamper-evident; it does not make it impossible to change or delete.
An evaluation reviews the monitoring scope, the metadata collected and how logs are handled in your environment before anything is enabled.
Policy controls · In development
Visibility informs better boundaries.
A coding assistant may need project files without needing payroll records. Understanding its activity helps you decide where that boundary belongs. AgentShield’s policy layer is in development, with rules set by your team for supported actions.
Product concept · Policy enforcement in development
Allow, observe or restrict
On supported actions, to be decided by policy rather than case by case.
Policies your team writes
Boundaries in your terms, to be applied at the endpoint.
An administrative console
Where policies, activity and tasks would be managed.
The current engine observes, discovers and classifies. It does not block actions; policy controls are not yet available.
Need guardrails designed and built now rather than later? That is Red Vault’s AI & LLM Security engagement — separate from AgentShield, built with your engineers, and never conditional on buying it.
Answers
Straight answers.
Product fit, privacy, deployment and availability — the questions to ask before bringing AgentShield into your organisation.
What is AgentShield?
AgentShield is an endpoint product in development from Red Vault. It identifies AI tools on a device, groups an assistant and its helpers into one agent, and connects observed files, commands and model connections. It gives security and IT teams context to understand AI adoption, investigate changes and decide where safeguards belong.
Who is it designed for?
Security and IT teams that need to understand AI use across their organisation, especially engineering teams using coding assistants, local models and connected tools. The first platform is macOS. The aim is to make observed AI activity easier to review alongside the tools and approval processes you already use.
When will it be available, and on which platforms?
Coming soon; no release date is published. macOS is the first platform, Linux is the next priority and Windows is planned. Supported versions and availability will be announced when confirmed. Register your interest below to hear from us when there is news.
How much will AgentShield cost?
Pricing and commercial terms have not been announced. You can register your interest and tell us about your devices, AI tools and intended use. We will share pricing when it is confirmed; this page is not an order or a paid subscription.
Does it block anything today?
No. The current engine observes, discovers and classifies. Policy controls for supported actions, and an administrative console, are in development. AgentShield should not be relied on to prevent an action or data loss today.
Do we need to change our AI tools or add an SDK?
AgentShield observes supported activity at system level rather than requiring an SDK inside each AI tool. This does not mean every tool or workflow is covered. An evaluation would check the tools, versions and configurations your team actually uses.
How would we deploy it?
Deployment is at the endpoint, with macOS first. Packaging, supported operating-system versions and rollout requirements will be confirmed with availability. We are not yet promising a finished fleet-management console or a particular MDM integration. Before an evaluation, we would agree the devices, permissions and monitoring scope.
Can it recognise unfamiliar AI tools?
Product names are one source of evidence. Behaviour, loaded frameworks and network activity can also surface unfamiliar AI-like activity for review. Recognition depends on the tool, version and configuration; an unfamiliar name does not automatically mean it is invisible, and detection is not guaranteed.
Does a high confidence or a behaviour change mean an attack?
No. Classification confidence describes how strongly the evidence suggests that activity is AI-related. An approved assistant can have high confidence. A behaviour change is a lead to investigate against the agent’s task and configuration. The current baseline is held in memory for that run; it is not a permanent history across restarts.
How is tool recognition checked?
The engine is exercised through automated tests and detection runs against real AI tools in macOS virtual machines. These checks help identify changes in how tools launch, what they load and where they connect. They do not establish an accuracy figure for your organisation; that requires testing your own representative workflows.
Does it see MCP?
It observes MCP-related activity over supported transports — stdio today — as context for an agent and its relationships. Coverage varies by transport and implementation. This is not a claim to inspect or control every MCP connection or tool call.
Does it store our files, prompts or keystrokes?
Selected local material an identified agent reads, writes or copies can be checked for content signals. Those checks record categories and hashes, not the source text. Environment-variable values are not recorded; input events are counted without reading keystrokes. Local model traffic is inspected for protocol shape inside the network extension. AgentShield is not a general-purpose reader of the meaning of all prompts and responses.
Does anything leave the device?
Core classification runs locally. Optional model-assisted analysis is off by default. If your team enables it with a remote provider, a reduced, redacted process profile is sent to that provider for a second opinion. An evaluation would agree which features are enabled, what metadata is collected and where it is processed.
Does AgentShield replace our security tools or a monitoring team?
No. It adds agent-level context about AI activity alongside software inventory, endpoint protection and identity controls. It is not a staffed monitoring or incident-response service. Red Vault’s AI & LLM Security consultancy is a separate engagement to design and build guardrails with your engineers.
Explore our AI & LLM Security engagementWhat would an evaluation help us establish?
Once an evaluation is available, we would agree representative devices, AI tools and workflows with your team. The review should establish what is recognised, whether the observed activity is useful, what metadata is collected and how the product fits your environment. Scope and availability would be agreed before work starts; registering interest does not guarantee immediate access.
AgentShield · Coming soon
Built for where your team works.
AgentShield is in development, starting with macOS. Here is our platform direction and what we are working towards before release.
Current development focus
macOS
Our first platform. The engine already identifies AI tools and connects their process, file and network activity on the Mac.
Where development stands
- AI discovery & classification
- Implemented in the engine
- Policy enforcement
- In development
- Public availability
- Coming soon
Next priority · Planned
Linux
The next platform priority after macOS, extending the product to Linux environments. Support is planned and is not available yet.
Future support · Planned
Windows
Part of our longer-term platform direction, following macOS and Linux. Supported versions and timing are still to be confirmed.
Release dates, supported versions and commercial terms will be shared when confirmed.
Hear when it is readyGet in touch
Let’s talk about AgentShield.
Have a question about AgentShield or want to explore a future evaluation? Tell us what your team needs and we’ll get back to you.
contact@redvault.co.uk