All pages
Investigate
Coverage
What Golem captures for each agent, what it finds on its own across your machines, and where it cannot see.
Golem sees what passes through the Golem agent on each machine. This page says which paths reach it, what each one carries, what Golem turns up on its own (agents' setups, unapproved MCP servers, AI tools nobody wired), and where it is blind. Read the gaps as carefully as the rest: they are where you need another control.
What Golem captures#
The paths into the Golem agent#
| Path | What it carries | Can it stop a call? |
|---|---|---|
| Agent hooks | Each tool call before it runs and its result after; session starts; slash commands | Yes, before the call runs |
| Golem's MCP gateway | Every call to an MCP server routed through it | Yes, the call never reaches the server |
| OpenTelemetry from Claude Code | Your prompts, tool results, model requests with tokens and cost, errors | No, it reports after the fact |
| Provider API proxies | Prompts and responses sent to the Anthropic, OpenAI or Gemini APIs, with model and tokens | No |
| Browser extension | Prompts, responses and attachments in ChatGPT, Claude.ai, Gemini and other AI chat sites, with estimated tokens | No |
| Editor extension | Edits, file operations, terminal commands and language-model activity in VS Code, Cursor, Windsurf and Antigravity | No |
| SDKs | Tool calls from your own agents built with the Python or TypeScript SDK | Yes, when the agent asks before it acts |
The hooks and the MCP entries are what the installer sets up in each client it finds. OpenTelemetry and the provider proxies are opt-in: you point the client at the Golem agent yourself. The browser and editor extensions are installed with golem install browser-extension and golem install editor-extension.
Per agent#
| Agent | How Golem sees it | Refuses before it runs | What it does not capture |
|---|---|---|---|
| Claude Code | Hooks, MCP; OpenTelemetry if you turn it on | Yes | Your prompts and its replies, unless OpenTelemetry is on |
| Cursor | Hooks in the app and the CLI, MCP | Yes | The CLI in -p mode sends no prompt or reply events |
| Codex | Hooks, MCP | Yes | Your prompts. Hooks run only once Codex trusts them. |
| GitHub Copilot | Hooks in the CLI and the VS Code agent, MCP | Yes | The Copilot cloud agent on GitHub |
| Gemini CLI | Hooks, MCP | Yes | Project-level hooks, and Windows |
| Devin | Hooks in Devin Desktop and the Devin CLI, MCP | Yes | Windsurf's older Cascade agent |
| Antigravity | Hooks, MCP; prompts and replies from its own transcript | Yes | Nothing beyond what its hooks and transcript hold |
| Hermes | Golem's plugin, MCP | Yes | First-sight tool checks do not apply to it |
| OpenClaw | Golem's plugin, MCP | Yes | Tool output and error text |
| Browser extension | The extension | No, it only observes | Exact token counts; it estimates them |
Whether a held call becomes the client's own approval prompt, or is refused, depends on the client. See Block, hold and contain.
MCP servers: hook or gateway#
Your own MCP servers stay in your clients' configs, and Golem sees their calls through the client's hooks as tool calls named for the server. That is enough to judge and refuse them in every client above. Routing a server through Golem's MCP gateway instead puts Golem in the connection itself, so a refused call never reaches the server even if a client skipped its hook. Golem's own servers always go through the gateway.
Security Inventory#
Watch → Security Inventory lists what your agents actually used, built from what passed through Golem rather than from what anyone registered:
| Tab | What it lists |
|---|---|
| MCP servers | Every server an agent called, with its definition |
| Tools | Every tool called |
| Commands | Shell command patterns |
| Skills & plugins | Skills, plugins and sub-agents the agents load |
| Repos | Repositories agents worked in |
| Shadow AI | AI tools on your machines, wired to Golem or not |
| Agent settings | Risky run modes per machine |
Each item can be decided Allow, Allow · read-only, Alert or Block. The views Needs a decision, Flagged by Golem, New this week, Blocked, still seen and Changed since decided sort the work. An item whose definition changes after you decided it shows up again under Changed since decided.
What agents load#
Every 30 minutes the Golem agent reads what each AI agent on the machine is set up to load:
- MCP servers for Claude Code (global, per project, and each repository's
.mcp.json), Cursor, Windsurf, Gemini CLI and Claude Desktop; - Claude Code's skills, commands, sub-agents and hooks (
~/.claude/settings.json); - instruction files:
CLAUDE.md(global and per project), Cursor rules, and the global Gemini, Codex and Windsurf instruction files.
It raises an Agent config scan alert for an MCP server or hook that pipes a download into a shell, hidden Unicode characters in an instruction file, a remote MCP server over plain http, or instructions telling the agent to hide something from you. It records, without alerting, packages run unpinned through npx or uvx and plaintext credentials in a config, the latter by name and never by value. It skips anything Golem installed itself. Turn it off under Alerts → Settings → Alert sources → Agent config scan.
How agents are set up to run#
Every 10 minutes the Golem agent also reads each agent's own settings and the flags it was started with, and reports risky run modes: permission prompts off, every shell command pre-allowed, workspace trust off, no sandbox. These appear on the Agent settings tab per machine. See Roll out to a fleet for using them.
Shadow AI#
MCP servers, tools and repositories nobody approved#
Under Security Inventory → Settings, choose what happens the first time an agent reaches something your workspace has not decided on:
| Setting | Applies to |
|---|---|
| Unreviewed MCP servers | A server not yet allowed in the inventory |
| Tools no agent has used | A tool no agent in the workspace has run before |
| Repos no agent has worked in | A repository no agent has worked in, such as a fresh clone |
Each is Allow (the default), Alert on first use or Block. A blocked server tells the agent that it is not approved and where an admin approves it; deciding Allow in the inventory is the approval. Golem's own servers and the clients' built-in tools are never treated as unapproved.
AI tools running without Golem#
Every 10 minutes the Golem agent also looks for AI tools on its machine, Golem-wired or not: agent CLIs, desktop apps, local model runners, and AI extensions in browsers and editors. They appear on the Shadow AI tab grouped as Agents & CLIs, Desktop apps, Local models and IDE & browser extensions, each with the machines it is on and one of three states:
| State | Meaning |
|---|---|
| Monitored | A client Golem wires, and it is wired here |
| Not wired | A client Golem can wire, but on this machine it is not, so Golem sees none of its calls |
| Not monitored | A tool Golem has no way to see into, such as a desktop chat app or a local model |
A tool newly found raises an alert naming the tool and the machine. A machine's first scan is recorded as its baseline without alerts, unless you turn on Alert on a machine's first scan. You can decide Allow or Alert on these; Block is marked not enforceable, because Golem cannot stop another program on a machine.
The security graph#
Conversations → Topology draws what actually ran as four columns: HOSTS, AGENTS, MCP SERVERS and TOOLS, with the repository each piece of work was in shown behind its agents. Lines join each agent to the servers and tools it called. Nodes are colored by the worst open flag on them, servers are marked when they are unapproved or quarantined, and sandboxed child agents appear in their own box. It covers the last 24 hours by default, and up to seven days.
The graph shows only what passed through Golem. A tool that never called through it is on the Shadow AI tab, not here.
Ghost sessions#
A ghost session is one whose last shell command put something in the background (nohup, disown, tmux, screen, a trailing &, or a background task) and which then went silent, by default for 24 hours. It is the pattern behind a runaway process nobody remembers starting, and behind a bill that arrives before anyone notices.
Hooks that go quiet#
A hook protects only while the client calls it. When Claude Code's OpenTelemetry export shows tools running with no matching hook call, Golem raises a Hooks quiet alert for that machine. This needs OpenTelemetry on, and works for Claude Code only.
On any single machine, golem doctor checks the wiring: that the service is running and enrolled, that Claude Code's MCP entries and hooks point at the Golem agent, that other clients' hook commands exist, that Codex trusts its hooks, that entries are being delivered, and that the machine's settings are current. It prints a fix for each failure.
Where coverage has gaps#
- Hooks are cooperative. A client calls its hooks and honors the answer. A client that skips them, or a process a shell command starts and leaves running, is outside what a hook can stop. The shell jail covers that for Claude Code on macOS only.
- Some clients give less. Codex, Gemini CLI and Devin cannot ask a person. Claude Code's prompts need OpenTelemetry. Antigravity's hooks carry no text of their own.
- Not covered at all: the Copilot cloud agent, Windsurf's Cascade agent, desktop chat apps, local models, and any AI tool on a machine without the Golem agent.
- The browser extension only watches. It cannot stop anything a person pastes into a chat site.
- One machine at a time. A machine that never installed the Golem agent does not appear anywhere. Your device management, not Golem, is the list of machines that should have it.