See every agent. Control every action.
A real-time, dynamic sandbox to monitor, govern, and secure every agent action at the source.
Block destructive changes with an intent-based policy
The Layer Underneath Your Agents
Qpoint is a dynamic sandbox that sits underneath every agent and harness. It sees each action as it happens, including the scripts and processes the agent starts, and decides right then based on the policies you write. Enforcement happens where the agent runs, based on the static rules and intent-based policies you define. Roll it out with the MDM or deployment tools you already use.
End users launch and use agents exactly as they do today with zero configuration changes.
Discover every agent, everywhere, and monitor everything they do
- Keep a live inventory of every agent on endpoints and in hosted environments, regardless of runtime, framework, or harness
- Stream every file, tool call, MCP route, and outbound request as it happens
- Attribute every action to the agent and session behind it
- Export everything to your existing observability stack
Set rules for how agents can be used and push them out to all endpoints
- Write policies in plain language that capture what you intend to allow
- Approve the MCP servers and tools that agents can use
- Define what's off limits, and apply it across every endpoint
- Surface policy violations with the agent and session attached
- Verify compliance with your own policies, backed by evidence
Enforce policies in the agent's execution path, based on intent, not just access
- Block reads of secrets
- Refuse unapproved endpoints
- Redact content on the way out
- Deny unapproved tool calls
- Redirect or rewrite actions instead of only blocking them
Policies can be static rules or intent-based policies evaluated by an AI judge.
Qpoint instruments the agent from the inside out
Qpoint taps directly into the AI agent runtime. No gateways, no sidecars, no SDK integration. A single binary on macOS, Windows, or Linux discovers every agent on a machine and captures every action it takes at the source, including everything done by the scripts, processes, and sub-agents it starts.
The result: your existing ops stack becomes agent-aware. Every event feeds into the SIEM, SOC, and compliance tooling you already operate.
Track every process an agent starts, not just its tool calls
Agent harnesses show you the tool calls an agent makes. When a tool call starts a script, a sub-agent, or an MCP server, that process reads files and sends requests on its own, outside the harness’s view. Qpoint records that activity and ties each event to the agent, session, and user that caused it.
Tool calls
Every tool call the agent makes, including MCP tool calls, with the tool name, input parameters, and results. This is the part the harness can see.
Scripts and commands
Every shell command and script the agent runs, with full command lines and exit codes, and the files and requests each one makes.
Sub-agents
Sub-agents start their own shells and processes. Qpoint tracks each one as an agent, linked to the session that started it.
MCP servers
MCP servers that run over stdio are child processes with their own file and network access. Qpoint records what they read and where they connect.
For every process, Qpoint records file reads, writes, creates, deletes, and permission changes, plus outbound connections, DNS lookups, and HTTP requests with headers, body, and response, including LLM API calls.
Static rules and intent-based policies
Policies apply to every agent and harness on the machine. Static rules check specific details of an action, such as the command, file path, MCP server, or host. Intent-based policies use an AI judge to score each action against a question you write in plain language. Both can flag or deny an action.
Watch us write a policy from scratch →Block git force pushes
Deny any git command that uses the --force flag, whether the agent runs it directly or from a script.
policies:
- title: No force pushes
if: event.type == "exec" && exec.program == "git" && exec.argv contains "--force"
actions: [deny]Allow only approved MCP servers
Define a list of approved servers. Tool calls to any other server are denied, and the agent gets a message explaining how to request access.
data:
approved_mcp_servers:
- github
- linear
policies:
- title: Unapproved MCP servers
if: event.type == "mcp.tool_call" && mcp.server not in data.approved_mcp_servers
actions: [deny]
denial_message: This server is not approved. Ask the security team for access.Flag data sent off the machine
The judge checks whether each command sends secrets, customer data, or private files to an outside server. Commands with a score of 0.8 or higher are flagged.
policies:
- title: Data leaving this machine
if: >-
event.type == "exec" &&
score("Does this command send secrets, customer data or private files from this machine to an outside server?",
[exec.command, exec.cwd]) >= 0.8
actions: [flag]Limit an agent to its stated purpose
Write a description of what the agent is supposed to do. The judge checks each command and MCP tool call against that description and denies anything outside it.
data:
purpose: >-
This agent reviews pull requests. It reads the code, runs the tests,
and posts findings as comments. It does not approve, merge, or push code.
policies:
- title: Outside the agent's purpose
if: >-
event.type in ["exec", "mcp.tool_call"] &&
score("Does this action go beyond what the agent's purpose allows?",
[data.purpose, context.exec.command ?? context.mcp]) >= 0.8
actions: [deny]
denial_message: A team member needs to do this.Watch the demo →Run Qpoint wherever your agents run
Laptops, servers, and other people's products. One binary, one event stream, deployed where the agents are.
Endpoints
Employee and engineer laptops, rolled out through the MDM you already use. Enforced locally, on or off the network.
Hosted agents
Containers, VMs, and clusters where agents run as services, pipelines, and background tasks. One deployment covers every node.
Embedded
Qpoint built into your own agent platform or product. Monitor, govern, and secure the agents your customers run.
Agent visibility and control for every team
Whether you're rolling agents out, running security, or accountable for it, Qpoint meets you where you are.
IT Operations
You need to know what's running on managed devices. With agents, you also need to know what they're doing: the files they touch, the tools they call, the servers they connect to. Qpoint gives you both, without changing how anyone works.
Security Teams
Your existing tools have no concept of an agent. Qpoint operates in the agent's execution path, which gives it a unique observation point, keeps every action attributed, and applies policy at the source.
CISOs
You are accountable for what agents are doing, but you're being asked to speed up adoption at the same time. Qpoint enables rapid adoption across the organization because you can see what agents do and prevent what they shouldn't.
Your ops stack wasn't built for AI agents
Each layer of your stack sees only a fragment of what an agent does, and none of them can judge intent.
Monitoring comes first: you can't govern or secure what you can't see.
Seconds, not sprints
Qpoint deploys as a single binary directly on the endpoint. No gateways to route through, no enterprise infrastructure to provision, no SDK integration to schedule.