AIshadow-ai-guard
GitHub
alpha · Apache-2.0 · free and open source

See every AI tool in use — and whose account it's on.

Shadow AI detection across browser, CLI, IDE, endpoint, network and cloud. One finding schema, one registry of known AI tools, one dashboard — running on infrastructure you already have, for roughly the cost of nothing.

View on GitHubTry it in five minutes
6
surfaces covered
1
finding schema
YAML
tool registry
£0
software cost

Why this exists

No single commercial tool sees all of the places AI turns up. CASB and DLP see the browser. Endpoint tools see installed applications. Cloud access tools see OAuth grants.

None of them read ~/.claude.json to tell you which account your developers' AI CLIs are signed into.

And the account is the part that matters: an approved tool on a personal account is unmanaged data flow, invisible spend, and an offboarding gap. Adding a new AI tool to detection is a merge request to a YAML file — not a script change on every endpoint.

Coverage

Six surfaces, one schema

browser

Browser

Managed extension policy plus a paste guard that stops secrets before they reach the prompt box.

cli

CLI

Reads ~/.claude.json and friends to report which account each AI CLI is actually signed into.

ide

IDE

Editor assistants and their config, inventoried from the endpoint rather than guessed at.

endpoint

Endpoint

Collectors for macOS (Jamf), Windows (Intune) and Linux (any RMM, cron or config management).

network

Network

SentinelOne DNS telemetry, including local process bridges that never touch the browser.

cloud

Cloud

Entra sign-ins, delegated access with OAuth scopes, Exchange signup evidence, Intune and Jamf inventory.

Demo

Try it in five minutes

No Kubernetes cluster, no MDM, no cloud logins. The demo runs the real receiver and a real Grafana dashboard against fake data, all in Docker — so you land on a dashboard that's already full instead of an empty one.

  • Dashboard at localhost:3000 — who runs what, personal vs work accounts, MCP integrations.
  • Browser paste guard at localhost:8090/demo/ running the extension's unmodified guard.js.
  • Paste a fake AWS key or card number and watch it stop before it reaches the page.
quickstart
  1. 1

    Clone the repo

    $ git clone https://github.com/AmanSK5/shadow-ai-guard.git
  2. 2

    Go into the demo folder

    $ cd shadow-ai-guard/demo

    shadow-ai-guard is the folder git just created; demo is where the compose file lives.

  3. 3

    Bring the stack up

    $ docker compose up

    Give it about 30 seconds — the receiver, Loki, the registry builder and Grafana all start and the demo data is seeded on startup.

  4. 4

    Open the two demo surfaces

    http://localhost:3000Grafana dashboard
    http://localhost:8090/demo/Paste guard demo

What you land on

The dashboard, before you install anything

A static recreation of the Grafana board the demo provisions at localhost:3000, with the same seeded data. The real one is backed by Loki and refreshes every five minutes.

AI Guard — Shadow AI Visibility

Devices reporting (24h)

8

…confirmed macOS

3

…confirmed Linux

3

…confirmed Windows

2

Who is running what (last 7 days)

usertoolsurfaceaccount_typeaccount_domaindevice
gengarcursordesktoppresence only—C02GENGAR
pikachuclaude-code-mcp:atlassian,figmamcppresence only—C02PIKACHU
bulbasaurdeepseeknetworkpresence only—NIX-BULBA
dittoollamadesktoppresence only—NIX-DITTO
snorlaxgithub-copilotidepresence only—WIN-SNORLAX
squirtlefirefliescloudpersonalgmail.com—
pikachuclaude-codeclipersonalgmail.comC02PIKACHU
charmanderchatgptbrowserpersonalgmail.comWIN-CHAR
eeveeclaude-codecliworkexample.comC02EEVEE
mewclaudedesktopworkexample.co.ukC02MEW
bulbasaurcodex-cliclipersonalgmail.comNIX-BULBA
gengar
cursor
surface
desktop
domain
—
device
C02GENGAR
pikachu
claude-code-mcp:atlassian,figma
surface
mcp
domain
—
device
C02PIKACHU
bulbasaur
deepseek
surface
network
domain
—
device
NIX-BULBA
ditto
ollama
surface
desktop
domain
—
device
NIX-DITTO
snorlax
github-copilot
surface
ide
domain
—
device
WIN-SNORLAX
squirtle
fireflies
surface
cloud
domain
gmail.com
device
—
pikachu
claude-code
surface
cli
domain
gmail.com
device
C02PIKACHU
charmander
chatgpt
surface
browser
domain
gmail.com
device
WIN-CHAR
eevee
claude-code
surface
cli
domain
example.com
device
C02EEVEE
mew
claude
surface
desktop
domain
example.co.uk
device
C02MEW
bulbasaur
codex-cli
surface
cli
domain
gmail.com
device
NIX-BULBA

Top tools (devices, 7d)

  • claude-code2
  • chatgpt1
  • claude1
  • claude-code-mcp:a…1
  • codex-cli1
  • cursor1
  • deepseek1
  • github-copilot1
  • ollama1

Findings by surface (7d)

  • desktop 3
  • cli 3
  • mcp 1
  • network 1
  • ide 1
  • cloud 1
  • browser 1

MCP integrations (who wired what, 7d)

tooluserdevice
claude-code-mcp:atlassian,figmapikachuC02PIKACHU

claude-code-mcp:atlassian,figma

user
pikachu
device
C02PIKACHU

Reading the board: presence of a tool is informational. Red means a personal (non-corporate) account is signed into an AI tool on a managed device, or an unexplained integration was found — in a real deployment those route to your alerting channel automatically.

In-browser playground

Or try the logic right here, no Docker

A simulation of two pieces of the system: the browser paste guard, and how a detection becomes a finding. Type into it and watch the report change. This is a re-implementation for the website — it runs entirely in your browser, sends nothing anywhere, and is not the shipped guard.js or a real collector. For the real thing, run the Docker demo above.

runs entirely in your browser
Mode:warn shows a "paste anyway" override; block does not

waiting for input

what would be reportedno pasted content
Nothing yet. Reports appear here exactly as the extension would send them to the receiver.

Architecture

How it works

browser extension ─┐
macOS collector  ──┤
Windows collector ─┼──► receiver ──► Loki ──► Grafana
Linux collector  ──┤       │
cloud scanners  ───┤       └──► Alertmanager ──► alerts
network scanner ───┘       ▲
   registry (YAML, reviewed) ─┘

receiver

FastAPI service. Accepts findings, logs structured JSON, fires alerts for personal accounts, serves the registry to collectors.

registry

The source of truth for what counts as an AI tool: domains, extension IDs, config paths, approval status. Schema-validated in CI.

scanner

Cloud and fleet scanners for Entra, Exchange, Intune, Jamf and SentinelOne. Each module is optional.

endpoint

Collectors that read AI tool config files for the signed-in account. This is the data no API-level product has.

discovery

Weekly job that classifies unrecognised AI-looking domains and proposes registry additions. A human approves every change.

dashboards

Grafana over Loki. Set your corporate domains in the dashboard variable and personal accounts light up red.

Finding schema

Every source emits the same shape

Any new scanner or collector that emits this works with everything downstream. severity is warn when the account domain isn't one of your corporate domains, info otherwise.

The user field carries an account name so a finding can be followed up with the right person.

Read the architecture docs →
finding.json
{
  "tool": "claude-code",
  "surface": "cli",
  "os": "macos",
  "account_domain": "gmail.com",
  "device": "SERIAL123",
  "user": "aman.test",
  "evidence": "~/.claude.json",
  "severity": "warn",
  "reported_at": "2026-01-01T09:00:00Z",
  "source": "collector-macos"
}

What you need

  • Kubernetes — for the receiver and scanner CronJobs today. Anything conformant; nothing is cloud-specific. The receiver is one stateless container and does not actually need an orchestrator, which is an open issue.
  • A log pipeline — that ingests container stdout. The dashboard assumes Loki; the receiver only emits JSON lines.
  • Grafana — for the dashboard, Alertmanager for alerting (optional).
  • One source per surface — Microsoft Graph, Jamf Pro, SentinelOne, managed extension policy, endpoint collectors.
  • Secrets — for whichever sources you enable, from Kubernetes Secrets or your secret store.

Prebuilt images are published to GHCR by CI, and a Helm chart at charts/ai-guard ships the compiled registry, so an install needs no build step.

Governance & privacy

The registry ships with every tool set to approved: false. Approval is your organisation's decision, not this project's default. The discovery job proposes additions; it never merges them.

Under ISO 42001 or similar, the registry doubles as your maintained inventory of AI systems in use, and the dashboard as its evidence.

This is workplace monitoring in most jurisdictions and usually warrants a DPIA. Read the deployment privacy guidance before rolling anything out.

Security model: one bearer token shared by reporting sources, rate-limited public ingest, findings carry usernames and device identifiers — treat your log store as sensitive.

Alpha

Status and known limitations

Released early on purpose. It runs in production in one environment, and the rough edges are labelled rather than hidden. Treat findings as leads to follow up, not verdicts.

Snap Chromium profiles

Browser extension inventory skips profiles under ~/snap on Linux, so an AI extension there stays invisible.

Sign-in coverage

Entra reads interactive sign-ins only. Non-interactive use is covered separately as delegated access findings; service principal sign-ins are not read as usage.

The Windows delivery path

Linux is driven end to end in CI and macOS has run on a fresh cluster. Windows has had the least real-world running — pilot on one machine first.

Hit something wrong or missing? Open an issue with the finding JSON and what you expected. That is genuinely useful.

Free, and always obtainable from the repo.

Apache-2.0. Others may legitimately charge for hosting, deployment or support, but the software itself is here at no cost. Before buying anything based on it, check what is actually being provided beyond the code.

Clone the repositoryGetting started guide