An engineer can wire a new MCP server into a coding agent in a minute, and from then on the agent sends it tool calls with whatever context it holds. Nobody files a ticket. Shadow AI detection has to start where that traffic leaves the laptop.

What is shadow AI detection?

Shadow AI is any AI tool, model, MCP server or skill that people use without a security review. Shadow AI detection means finding those items in what actually runs, then deciding what happens to each one. On engineering teams, most unsanctioned AI now lives inside coding agents: unapproved MCP servers, skills loaded into context, models picked per request.

We detect shadow AI on the device, in the traffic path. Formal Endpoint intercepts the LLM and MCP traffic of known AI agents and the processes they start. Discovery then reflects what shadow AI tools actually do on the wire, not what people remember to declare.

Why do coding agents make shadow AI harder to see?

Three things change once agents do the work:

  • MCP servers act on the agent’s behalf. The MCP specification says tools “represent arbitrary code execution and must be treated with appropriate caution”. An unreviewed server gets tool calls carrying whatever the agent has in context.
  • Skills are instructions nobody reviews. In Claude Code, a skill is a folder holding a SKILL.md file that the agent can load into a conversation. It changes what the agent does without going through code review or a package registry.
  • Agents spawn processes. A coding agent starts shells, git and package managers. Their connections only look like agent traffic if you follow the process tree.

Here’s the catch: a destination allowlist can’t tell an engineer’s request from an agent’s tool call to the same host. Shadow AI security needs the process identity and the protocol, not just the hostname.

How does Formal detect shadow AI on laptops?

Formal finds shadow AI in four moves, all on the Endpoint:

  1. A network rule selects the traffic. In Transparent Mode, a network rule matches known agents and their child processes, then keeps flows classified as mcp or llm.
  2. The Endpoint reads the protocol. It terminates TLS with a local Formal CA, so it can parse MCP JSON-RPC and LLM requests, log them and evaluate policy.
  3. Unknown MCP servers enter the queue. MCP requests to a server that has no Formal Resource show up on the Shadow AI MCP Servers tab, with the server endpoint and Last Used. The tab refreshes every 15 minutes. Servers reached through Claude’s connector proxy carry a Claude Connector badge.
  4. Skills come from Claude Code requests. Claude Code requests list the skills available to the agent and the ones loaded into the conversation. The Skills tab marks each one Loaded or On device, and refreshes every 24 hours.

The Claude Code and Cursor pages cover each agent, and the Shadow AI docs walk through the review flow.

Shadow MCP servers and skills: what does Formal find, and what doesn’t it see?

When you compare shadow AI detection tools, check where each one sits and what it can’t see. Here are our limits, as documented:

  • Proxied traffic only. Formal finds items in traffic it intercepts. A device without the Endpoint, or traffic no network rule matches, stays invisible.
  • macOS and Linux. Transparent Mode and network rules run on macOS and Linux. On Windows, the Endpoint connects people to Resources through local listeners and doesn’t intercept agent traffic yet.
  • Skills from Claude Code. Formal detects skills in Claude Code requests only. Skills used by other agents don’t appear in the queue.
  • MCP servers and skills are the review queue. AI client applications, models and providers appear on the usage pages as an inventory, but the allow or block queue covers MCP servers and skills.
  • Clients must trust the Formal CA. Node.js and most Python clients ship their own roots. By default, the Endpoint points Claude Code at a bundle that includes the Formal CA.

How do you govern shadow AI without blocking developers?

Shadow AI governance works when the approved path is easier than the workaround: one default per item type, a Catalog that records each decision, and a request flow for exceptions.

Pick the default. Guardrails has one setting for unknown MCP servers and one for unknown skills. Allow lets the traffic through, logs it and queues the item for review. Block stops it with a generated policy. We suggest starting with allow and monitor to build the inventory, then switching to block once the Catalog covers what teams need.

Make the block useful. A blocked MCP tool call returns an advisory written for the agent. It lists the approved MCP servers and asks the user to switch to one, request the blocked server through a Formal form (once you create one), or do nothing for now. Blocked skills show Formal’s standard block message.

Handle exceptions. Employees request MCP servers, or exceptions to a blocking policy, from the employee Catalog. Admins approve one-time, time-bound (30 minutes to 7 days) or permanent access in Access Requests. It sends no notifications, so pair it with a Slack flow in Workflows when requests are urgent. Approved MCP servers can then run through a central MCP gateway.

How do you monitor AI usage and spend?

AI usage monitoring in Formal is a set of read-only pages built from proxied traffic: Usage, Models, MCPs, Skills, Applications (such as Claude Code) and Providers (such as Anthropic). Each inventory covers the last 30 days with users, requests, policy hits, first seen and last used, linked to the matching logs. See the AI usage docs.

Spend follows from the same traffic. You set token prices, Formal estimates the cost of each LLM request, and a policy can cap what each user spends per day, week or month. For controls on LLM traffic itself, see AI gateway.

Two features go beyond counting. Insights reviews LLM traffic every 15 minutes against the OWASP Top 10 for LLM Applications (2025) and forwards findings to your log integrations, so they reach your SIEM. Assessments score each tool call for risk and for alignment with the user’s intent, and response policies can block on those scores.

Why put the control point in the traffic path?

An inventory collected by survey is out of date the day an agent loads a new skill. A control point in the traffic path sees what agents call and enforces a decision on the next request. At Cursor, agents reach sensitive data through Formal’s Connector, which inspects every request and enforces scoped policies:

“Without Formal, we couldn’t have agents with access to sensitive data. With Formal, because we are able to inspect all traffic and enforce controls, we are able to provide a safe environment for the agents to get the job done.”

— Travis McPeak, Head of Security @ Cursor

Read how Cursor gives engineers and AI agents secure access, or see how Formal handles agent egress beyond AI traffic.