AI agents operate across three planes that no single security tool can see. ByteBunker Labs builds observability for the agentic era.
AI agents operate across external APIs, internal networks, and local endpoints. SASE sees the first. MCP gateways see part of the second. Nobody sees the third. That gap is where shadow agents live.
Calls to model providers — OpenAI, Anthropic, Google. Your SASE platform sees opaque HTTPS traffic but can't read prompts, tool calls, or agent decisions.
MCP servers talking to databases, Active Directory, Splunk. This traffic is bypassed from SASE inspection to avoid latency. It's completely unmonitored.
Process-to-process stdio communication, config files, agent instructions. Entirely local to the workstation. Invisible to every network tool.
Spectis is a telemetry and correlation layer — not a gateway, not a proxy. It observes without intercepting, correlates across all three planes, and ships intelligence to your existing SIEM.
Scans MCP configs across 21 AI clients (VS Code, Cursor, Claude Desktop, Claude Code, Codex CLI, Windsurf, Zed, JetBrains, and more), detects running MCP processes, probes tool inventories, finds shadow servers. Cross-platform: macOS, Windows, Linux.
Every agent gets a registered identity with scoped permissions. Every action is attributed to both the agent and the human who triggered it. Full delegation chain.
Async behavioral analysis that catches what rules miss: reconnaissance patterns, data exfiltration via read-only access, prompt injection, and privilege creep across sessions.
Ships structured telemetry to Splunk, Sentinel, and Defender. Correlates endpoint state + agent identity + tool calls + network traffic using shared identity keys.
Developers + AI Clients VS Code Cursor Claude Codex CLI Windsurf Zed JetBrains +14 more | | | | | v v v v v +-------------------------------------------------------------+ | Spectis Correlation Engine | | Joins by: username x hostname x timestamp x agent_id | +--------------+--------------+------------+-----------------+ | Endpoint | Orchestrator | Provider | Network | | 21 clients | Agent ID | API logs | FW | | MCP scanner | User ID | Token use | DNS logs | | Process mon | Tool calls | | | | Tool prober | Sessions | | | +--------------+--------------+------------+-----------------+ | v Splunk . Sentinel . Defender . Dashboard
A unified control plane for security teams. See what's running, who approved it, and what risk it carries — across every endpoint in your organization.
Our upcoming whitepaper presents the first systematic mapping of MCP configuration paths across all major AI clients and a formal agent identity model for enterprise security.
We demonstrate that SASE, MCP gateway, and EDR tools each cover at most one plane of AI agent activity. We present Spectis and evaluate it against a production enterprise environment.
| Tool | API | Network | Endpoint |
|---|---|---|---|
| SASE | ~ | — | — |
| MCP Gateway | — | ~ | — |
| EDR / XDR | — | — | ~ |
| Spectis | ✓ | ✓ | ✓ |
Spectis is open source. Deploy the endpoint scanner today. Ship telemetry to your SIEM tomorrow.
Get started Read the research