Your agents have a shell. Do you have eyes?
Coding agents run commands, edit files and talk to models on your behalf. GreyArm gives you the process-level view: every agent, every shell it opens, every endpoint it reaches.
Claude Code, Cursor, Copilot, Codex, Gemini CLI, Aider, Cline and more — with the shells they spawn and the secrets they go near.
Every Model Context Protocol server, which client launched it and what it was given access to.
Ollama, LM Studio, llama.cpp — and an alert when one is reachable from the rest of your network.
Investigate it like a pro.
Executable path, code-signing publisher, SHA-256, parent process, launched tools and the exact AI hosts it reached — with a risk score that explains itself.
A sensor for every box in the rack.
Run the sensor on your Linux servers and mini PCs, link them to one account, and see every agent and model server you run. Approve what’s yours; hear about anything new the moment it appears.
