See all your AI agents across the fleet. Stop them leaking your secrets.

  Release Date: September 7, 2026

AI agents read files, run commands, and call MCP servers on your developers' behalf. Most teams cannot say which agents are deployed across the fleet, and which of them touch credentials. Secrets that leave in a prompt or tool call never hit a commit or a pull request, so your existing controls never see them.

Developer Endpoint Protection now does both:

• AI Hooks block secrets inside the tool.
• The AI agents and MCP inventory shows what is actually out there, including AI Agents running under personal subscriptions.

What does this mean for you?

• Codex and Mistral Vibe: AI Hooks now cover them alongside Claude Code, Cursor, Copilot CLI, and VS Code. They scan prompt submission, pre-tool use, and post-tool use. A block names the secret and how to remove it, so the developer or agent can fix and retry.
• One command per machine: ggshield machine setup configures the hooks for every detected AI agents on the machine, along with git hooks.
• Shadow AI you can see: the inventory reports agents and MCP servers per endpoint, hook coverage, and whether an agent's subscription is personal or company.
• Faster incident response: after a compromise, you know which agents were on the machine, which MCP servers they used, and what those servers could reach. Add --history to ggshield ai discover to get the MCP tool calls parsed from the agent's transcripts.

Why is this important?

Developers using AI coding tools leak secrets at roughly twice the baseline rate. GitGuardian found 24,008 unique secrets in public MCP configuration files in 2025 cf. The State of Secrets Sprawl 2026.

Hooks stop the leak at the tool. The inventory tells you where to look.

Get started now

1. Upgrade ggshield to 1.54.0 or later.
2. Follow the Developer Endpoint Protection deployment docs to roll it out across the fleet.

Enhancements

• Team Perimeter: Added a workspace setting to automatically remove sources deleted on the remote from team perimeters, while keeping them accessible to workspace managers.
• NHI Governance: AWS access keys stored in a secret manager or Kubernetes now link to their IAM identity by AccessKeyId, so the exploration map shows the permissions of that stored key.

Fixes

• Incidents: Fixed an issue where source locations were recomputed too frequently, causing excessive repository clones and bandwidth usage.