Secure AI agents everywhere they run.
On laptops, in code and cloud, and inside SaaS platforms. NoFly finds every agent, decides each action before it runs, attacks its own defences and keeps one record of all of it.
Three places agents run. One gate.
Each place has different builders, different architecture and different risks. NoFly covers all three with the same inventory, the same rules and the same record.
Coding agents on laptops
Developers run Claude Code, Cursor, Copilot CLI and Codex with their own access, connected to MCP servers that reach source code, internal APIs and production data. Most were installed in a minute, without a review.
- Found through the EDR and MDM you already run, or one scan per machine
- A gate inside each agent decides every command and tool call before it runs
- Critical moves refused on the machine, even offline
Agents and AI apps in code and cloud
Engineering teams build agents with LangChain, the OpenAI Agents SDK and CrewAI, and ship them on Bedrock, Azure and Google Cloud. They reach customers and production systems, so they carry the widest blast radius.
- An MCP gateway and a model proxy apply the same rules with no code changes
- Plugins for the API gateway you already run: Kong, Envoy, LiteLLM, Portkey and more
- Runs from Langfuse, Helicone or OpenTelemetry traces joined into one record
Agents in SaaS platforms
Sales, support, finance and HR teams build agents in Copilot Studio, Agentforce, n8n and ServiceNow, often without telling security. They read and change CRM records, tickets and invoices.
- Imported by name as governed agents, in monitor mode first
- Inline blocking on Copilot Studio, Agentforce, Bedrock Agents, Azure AI Foundry and n8n
- Monitoring for the rest, and labelled as monitoring
Point tools see one surface. Agents cross all of them.
An agent reads a ticket in one system, calls a tool through another and sends data through a third. Security that lives in one of those places sees a third of the story.
- NOFLY01
Every surface, one decision
The same rule runs in coding-agent hooks, the MCP gateway, the model proxy, hosted-agent callbacks and pull requests, so an action is judged the same way wherever it happens.
- NOFLY02
The whole run in view
Each call is judged with who asked, what the agent read before it, and where the instruction came from. Secrets and personal data are followed from where they were read to where they are sent, across sub-agents.
- NOFLY03
Each control feeds the next
Discovery gives the gate identities to enforce. Attacks grade every control they pass through. Breaches become protections, causes become rules, and every decision lands in one tamper-evident record.
What teams use it for.
Where an incident has already happened in the wild, the card links to our breakdown of it.
U1Coding agent security
ProtectDiscoverReal incident · April 2026A Cursor agent deleted a production volume and its backups in nine secondsHooks inside Claude Code, Cursor, Copilot CLI, Codex CLI, Gemini CLI, Windsurf and Cline decide every command and tool call before it runs.
U2MCP security
DiscoverProtectInterrogateReal incident · September 2025A fake Postmark MCP server copied every email it sent to an attackerEvery MCP server found, scanned in a sandbox, approved or denied, questioned for a second face and watched for drift behind one gateway.
U3Shadow AI
DiscoverAI use found from network egress, enrolled machines, OAuth consents, the browser and the vendors’ own admin APIs, named per person.
U4Agent identity and least privilege
ProtectGovernEach agent gets its own identity, allow-lists and short-lived keys. Grants nobody uses are surfaced for removal, and a leaver’s agents are offboarded.
U5Prompt injection and data leaks
ProtectExplainReal incident · May 2025A public GitHub issue could steer an agent into leaking private repositoriesContent from outside is screened before the agent acts on it, secrets are followed from read to send, and the cause of a risky action is named.
U6AI supply chain
DiscoverInterrogateReal incident · August 2025Malicious Nx packages turned developers’ AI CLIs into secret huntersModel files, packages, MCP servers and skills checked before they run, matched against OSV and CISA KEV, and re-checked when a new advisory lands.
U7Destructive actions
PreviewProtectReal incident · July 2025Replit’s agent deleted a production database during a code freezeDeletes, sends, shares and payments measured on a copy before they run, and held for a person with the real numbers.
U8Compliance and audit
GovernVerifyEvery rule, finding and control mapped to OWASP, MITRE ATLAS, NIST AI RMF, ISO/IEC 42001 and the EU AI Act, with a tamper-evident record and graded controls.
The AI you already run.
Coding agents, agent platforms, model providers, and the identity, ticketing and security tools around them. Every connection is read-only unless you ask for more.
What each integration does