BeProof
DocsPilot

Make AI agents visible, reviewable, and auditable.

Discover AI agents, access paths, and coverage gaps across employee workstations — and turn them into reviewable audit evidence for security, compliance, IT, and risk teams.

Discover AI agents, access paths, and coverage gaps across employee workstations — and turn them into reviewable audit evidence for security and compliance teams.

Request 30-day pilot

Local-first. Metadata-only. No raw secrets. Gaps are explicit.

BeProof · Workstation Audit

BeProof Overview showing readiness, risks, agents detected, and evidence collected
Agents detected5
Access references227
Open findings3

Example audit snapshot · macOS (first endpoint wedge)

The gap

AI agents are moving faster than security can audit them.

AI agents have moved from chat to action. Employees now connect AI tools to files, browsers, SaaS apps, local workflows, credentials, APIs, and automation systems. But most security stacks still track users, devices, SaaS seats, and network events — not which AI agents exist, what they can access, what was used, and where evidence is missing.

AI moved from chat to action

Agents no longer just answer questions. They summarize work data, operate across apps, trigger workflows, and connect to internal systems.

Access paths are scattered

Credentials, OAuth grants, MCP servers, browser sessions, SaaS permissions, files, APIs, and local automations create access paths that are hard to review together.

Evidence is incomplete

Admin consoles show seats and settings. They rarely prove what exists locally, what was granted, what was used, or where the audit cannot make a clean claim.

GRC tracks controls. EDR tracks devices. SaaS admin tracks seats.BeProof tracks AI-agent evidence across the gaps.

Detection coverage

Know which AI agents are present — and where visibility stops.

BeProof detects local and cloud AI agent surfaces across Codex, Claude Code, Cursor, MCP servers, credentials, grants, and usage signals. When evidence is missing, BeProof reports a coverage gap instead of giving a false clean result.

BeProof inventories configured agents, access grants, observed usage, and coverage gaps — without collecting raw secrets.

Coding agents

Codex, Claude Code, Cursor, Open Claw, Windsurf, Cline, Aider, Continue, Copilot

BeProof detects Local configs, usage signals, credential metadata, managed policy paths

MCP servers

.mcp.json, local commands, network endpoints

BeProof detects Command execution, env credential references, first-seen servers

Cloud agents

OpenAI, Anthropic, Cursor, GitHub cloud declarations and usage

BeProof detects Cloud-declared surfaces, grant edges, connector readiness, account attribution

Package / install signals

Homebrew, npm/pnpm global, VS Code / Cursor / Windsurf extensions

BeProof detects Install inventory (POL-X01) and install_inventory coverage gaps

View coverage

Coverage depends on platform, scan scope, user or admin consent, and configured cloud connectors. BeProof never stores raw secrets and does not inspect network payloads.

Proof-backed coverage

Not just a list of tools. A proof-backed coverage map.

BeProof shows which agent surfaces were expected, which were scanned, what evidence was found, and where visibility is incomplete — the same matrix security reviewers see inside the endpoint app (macOS first).

Full surface catalog
Coverage for this auditExample
SurfaceExpectedScannedResult
Codex local configYesYesFound
Open Claw usageYesYesFound
Cursor cloud grantsYesNoConnector required
MCP network endpointYesYesReview required

  • Codex local config

    Expected
    Yes
    Scanned
    Yes

    Found

  • Open Claw usage

    Expected
    Yes
    Scanned
    Yes

    Found

  • Cursor cloud grants

    Expected
    Yes
    Scanned
    No

    Connector required

  • MCP network endpoint

    Expected
    Yes
    Scanned
    Yes

    Review required

Completeness is tracked separately for Declared, Granted, Observed, and Trust — not collapsed into a single score.

Evidence model

One evidence model for every AI surface.

BeProof does not silently pass incomplete audits. It separates presence, access, observed activity, and missing evidence into a workflow security teams can review.

  1. DeclaredWhat exists or is configured.AI assistant, MCP config, local automation
  2. GrantedWhat access or permissions exist.Credential reference, OAuth grant, SaaS scope
  3. ObservedWhat activity signals can be verified.Usage event, run history, stale workflow
  4. CoverageGapWhat cannot be proven yet.Missing connector, blocked source, consent needed
FindingReviewExceptionSigned Export

Missing evidence does not become a clean report. BeProof separates verified facts from review items, exceptions, and coverage gaps.

Product proof

From workstation signals to audit-ready evidence.

BeProof turns endpoint-level AI signals into structured evidence your team can review, approve, export, and verify.

OverviewSee readiness, active risks, detected agents, collected evidence, and open reviews.
Review QueueTurn unknown agents, MCP servers, credential references, and gaps into auditable decisions.
Access and UsageCorrelate what is configured, what is granted, and what activity can be verified.
Admin ConsoleGive security teams a fleet posture view without sending raw endpoint evidence upstream.
Pilot deliverables

Sample evidence pack

A pilot should end with evidence your security and compliance teams can actually use.

What you can prove

BeProof turns scattered AI-agent signals into evidence your team can review, explain, export, and verify.

Discovered AI agents and assistants

Which agents, assistants, automations, and MCP servers were found on employee workstations.

Access paths and credential references

Which grants, credential references, connected systems, and permission paths need review.

Observed usage signals

Which usage events, run histories, or activity signals were available for verification.

Coverage gaps

Which sources were missing, blocked, partial, stale, or consent-gated.

Review decisions and exceptions

Which findings were approved, rejected, remediated, or accepted as risk.

Exportable evidence

Which evidence package can be shared with security, compliance, or audit reviewers.

What you receive after a 30-day pilot

AI-agent inventoryA list of discovered agents, assistants, automations, MCP servers, and relevant workstation surfaces.
Access review summaryCredential references, grants, connected systems, and access paths requiring review.
Findings reviewPolicy findings grouped by severity, status, source, and owner.
Coverage gap registerMissing, blocked, stale, partial, or consent-gated evidence sources.
Exception logApproved exceptions, accepted risks, remediation decisions, and review history.
Signed evidence exportA reviewable package with metadata, findings, coverage status, and verification manifest.

Redacted sample artifact

Review a sanitized export structure before starting a pilot — inventory, findings, coverage status, and a signed manifest.

Open sample JSON

Audit summary

Agents detected
5
Access references
227
Usage signals
45
Open findings
3
Coverage gaps
0

Sample findings

  • CriticalUnapproved MCP local commandPOL-F01
  • MediumConfigured but unused automationPOL-O01

Export manifest

Algorithm
ed25519-v1
Artifact SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
How export verification works
Request 30-day pilot
Use cases

Built for security, compliance, IT, and risk teams.

BeProof gives security, compliance, IT, and risk teams a shared evidence layer instead of fragmented screenshots, policy attestations, and incomplete SaaS admin exports.

AI agent inventory

Discover which AI agents, assistants, automations, and MCP servers are present across employee workstations.

Access review

Review credential references, cloud grants, connected systems, and permission paths.

Audit evidence export

Produce reviewable evidence packages for security reviews, SOC 2 readiness, ISO readiness, and internal audits.

Deployment

Start local. Scale across your fleet.

BeProof is designed for security-led rollout on employee workstations — from a focused pilot group to MDM-managed fleet deployment when you scale.

First endpoint wedge: macOS evidence for local AI agents, MCP servers, credential references, and automation workflows — not the product boundary.

Workstation endpoint scans

BeProof collects local AI-agent surfaces, MCP configs, credential references, and automation evidence on employee endpoints. macOS is the first endpoint wedge — the same evidence model expands to browsers, SaaS tools, desktop apps, and autonomous agents.

MDM optional for fleets

Start with a focused pilot group. Managed deployment via Jamf, Intune, Kandji, or Fleet is supported when you scale.

Metadata-only upstream

Shared reports and fleet summaries include findings, review status, and coverage gaps — not raw secrets from endpoints.

Admin console for review

Security teams get fleet posture, review queues, and export verification without pulling full endpoint dumps into the cloud.

Detection coverageReference architectureManaged deployment guideTrust & data handling
FAQ

Common buyer questions

Who is BeProof for?

Security, compliance, IT, and risk teams at companies where employees use AI agents, assistants, MCP servers, and automations across workstations, SaaS tools, and local workflows — especially when audit evidence is fragmented across SaaS admin, policy attestations, and endpoint blind spots.

How is BeProof deployed?

Start with a 30-day pilot on a focused endpoint group (macOS available today). Install the BeProof app on workstations or roll out via MDM for managed fleets. The admin console supports fleet enrollment, review workflows, and signed summary ingest.

Does BeProof replace GRC, EDR, or SaaS admin?

No. BeProof complements SOC 2, ISO 27001, and internal security programs. It adds AI-agent-specific evidence across the gaps that GRC, IAM, EDR, DLP, MDM, and SaaS administration do not fully cover.

What data leaves the endpoint?

By default, sensitive collection stays local. Shared exports and fleet summaries use metadata, findings, review decisions, coverage gaps, and verification manifests — not raw secret values.

What does the 30-day pilot include?

Workstation scanning, AI-agent inventory review, access path review, findings triage, coverage gap reporting, exception workflow, and a signed evidence export your security and compliance teams can review.

Compliance evidence

Close the AI-agent evidence gap in SOC 2 and ISO readiness.

When auditors or internal reviewers ask how your company governs AI-agent usage, BeProof gives your team a repeatable evidence package: inventory, access review, findings, exceptions, coverage gaps, and signed exports.

AI agent inventoryAccess and credential reference reviewCoverage gaps and exceptionsSigned / tamper-evident exports

BeProof complements SOC 2, ISO 27001, and internal security programs. It does not replace GRC, IAM, EDR, DLP, MDM, or SaaS administration.

Designed for sensitive environments

Security proof without raw secrets.

  • Local-first processing
  • Credential metadata, not secret values
  • No raw secrets in reports
  • Consent-gated sensitive sources
  • Coverage gaps instead of false passes
  • Signed / tamper-evident exports
Raw local evidence stays on the endpoint by default. Shared reports include metadata, findings, review decisions, coverage gaps, and verification manifests.
30-day pilot

Start with an AI Agent Audit Pilot.

Scan a focused workstation group, review AI-agent presence and access paths, identify coverage gaps, and export an evidence pack for security and compliance review.

At the end of the pilot, your team receives an AI-agent inventory, access review summary, findings review, coverage gap register, exception log, and exportable evidence package.

  1. Week 1

    Scan a small group of managed workstations

  2. Week 2

    Review agents, automations, access paths, and coverage gaps

  3. Week 3

    Map findings to internal security controls

  4. Week 4

    Export an evidence pack for security and compliance review

Request 30-day pilotContact usView sample evidence pack