Inventory
Find approved metadata about local AI clients, MCP servers, skills, plugins, and agent harnesses without reading prompts, results, secrets, or employee activity.
Onterix Endpoint
Find local AI paths. Move them onto the governed path.
Discover local AI clients, MCP servers, skills, plugins, and agents. Start without device management, or deploy across a managed fleet. Add monitoring and enforcement only where the client and risk require it.
Coverage that says what it knows
Inventory, monitoring, and enforcement are separate choices.
Discovery does not imply control. Onterix reports the coverage each client actually supports, then applies the same runtime contract wherever enforcement is available.
Monitor
Show which supported requests followed the governed path, which remained outside it, and why coverage is incomplete.
Enforce
For supported clients, require requests to enter the same Onterix runtime used by agents, APIs, and workflows before tools run or data is released.
Three rollout paths, one client
Start directly. Add management certainty when you need it.
The client and wire contract stay the same. Device management adds installation certainty, configuration lock, managed identity, update control, and tamper resistance—not a second policy system.
Let a person enroll a device
Install Onterix Endpoint, complete a short device flow, and begin with metadata-only inventory. A device-held key authenticates the installation without becoming the person’s authority.
Standardize a team rollout
Publish an enrollment profile, assign owners and policy, stage updates, and review drift while people install through an approved company process.
Prove fleet coverage
Deploy signed packages, managed identity, locked configuration, update rings, and uninstall policy through the device-management system you already use.
Useful findings, reviewed changes
Turn proven local demand into a governed capability.
When a team is already using a useful MCP server, skill, or workflow, Onterix can create a cited draft for review. Discovery never publishes a tool, imports a credential, grants access, or starts a run.
See the capability runtimeApproved metadata only
Record type, version, ownership, supported client, prevalence, and risk context without copying the local artifact.
A draft with provenance
Show where the finding came from, what the proposed capability would do, and which checks remain.
The normal gates still apply
Test, approve, and publish through the same capability lifecycle. Every later run uses current actor and source authority.
Privacy by default
Observe configuration risk—not employee activity.
Onterix Endpoint minimizes locally before anything leaves the device and sends detailed events directly to the selected Onterix region or your own data plane.
- No packet capture or TLS interception
- No keystrokes, screenshots, clipboard, or browser history
- No raw environment values, tokens, prompts, inputs, or results
- No employee scoring, remote shell, or arbitrary device control
Endpoint rollout
Start with one device or plan a managed fleet.
Choose the clients to inventory, the metadata to collect, the coverage you need, and where endpoint events must stay.