Developers are running AI coding agents on their laptops with no centralized visibility. Claude Code, Codex, VS Code extensions, MCP servers, and custom skills each store their own credentials, follow their own configuration formats, and operate outside the reach of traditional endpoint management. Solo.io released agentdesktop, an open-source project under Apache 2.0, to give security and platform teams a way to govern this growing sprawl without replacing the MDM tools already in place.

The Visibility Gap on Developer Desktops

Enterprise security teams have spent years building visibility into cloud and Kubernetes environments. They know what containers are running, what services talk to each other, and what credentials are in use. Developer laptops are a blind spot. Every week brings a new AI tool: Claude Code, Codex, Grok Bot, OpenClaw, MCP servers connected to various model providers. Each one stores API keys in local config files, environment variables, or OS credential stores. Each one follows its own sandbox rules. None of them report into a central system.

As Solo.io founder and CEO Idit Levine put it, "Every organization is struggling with AI agents and tooling sprawl. We at Solo.io are no different. Claude? Codex? Every week some new tool is being released. Tools, API keys, hundreds of providers, and zero visibility."

Agentdesktop addresses this by running a daemon on each workstation that discovers AI tools, agent harnesses, MCP servers, skills, and models across the endpoint fleet. It associates each tool with a device and user. From there, IT, platform, and security teams can centrally manage and version native configurations for supported tools. The inventory is not limited to a single vendor. It covers whatever AI tooling developers have installed.

Translating Policies Across Different Harnesses

The most technically interesting claim is policy translation. An organization defines a single security policy, perhaps allowing agent-run commands to write to specified directories, blocking access to SSH keys, and restricting network connectivity to approved domains. Agentdesktop transforms that policy into the distinct native configuration syntax required by each AI-agent harness.

This matters because conventional endpoint tools distribute scripts and profiles, but those scripts must continually track changes to each agent tool's paths, schemas, and behavior. Claude Code uses a different config format than Codex. MCP servers have their own configuration conventions. A governance layer that requires manual maintenance of separate scripts for JSON, JSONC, TOML, and other formats becomes a maintenance burden that falls behind the pace of tool changes.

Agentdesktop handles the translation centrally. The organization writes one policy. The daemon applies it in the language each harness understands. When a new tool is added, only its translation layer needs updating, not every policy definition across the fleet.

Replacing Long-Lived API Keys With Short-Lived Tokens

The credential management problem is immediate and practical. Developers store long-lived API keys for OpenAI, Anthropic, and other providers in config files, environment variables, and credential stores. These keys often have broad permissions and no expiration. If a laptop is lost, stolen, or compromised, those credentials are exposed with no automatic revocation.

Agentdesktop's approach replaces persistent keys with short-lived credentials. The local daemon binds a device key and certificate to a user authenticated through single sign-on. The controller issues a time-limited JSON Web Token identifying the user, enrolled device, and an allowed client label such as claude-code or codex. The organization's LLM gateway validates that token and injects the actual provider API key, keeping the provider credential off the workstation entirely.

Gateway telemetry can then attribute model and token usage to the specific user, device, and tool label. This closes a gap that most organizations have: they know they are paying for API usage but cannot connect that usage to individual developers or specific tools.

Solo.io acknowledges a current limitation. The client ID in this workflow is an asserted client label, not a cryptographic proof of the executable process. A different process within the same local user boundary could potentially request another permitted label. The identifier is currently useful for routing, policy, logging, and attribution. Future versions are intended to add SPIFFE SVID-based identity for cryptographic proof.

Two Deployment Modes

Agentdesktop supports standalone and enterprise deployment. In standalone mode, a developer or security team runs it on a single workstation using a local YAML configuration file. A dry-run option previews or reconciles the settings it would apply without making changes. The standalone configuration specifies sandbox rules, agent-tool settings, an LLM gateway, and SSO authentication.

For enterprise rollouts, the endpoint daemon deploys through existing MDM software. A centrally managed controller provides fleet inventory, user and device enrollment, versioned configuration, credential issuance, and reporting. The controller integrates with the organization's existing identity provider, PKI, database, and LLM gateway. It can run centrally, including on Kubernetes.

The division of labor is deliberate. MDM continues to manage the underlying device and operating-system posture. Agentdesktop discovers and configures supported AI tooling and establishes device-and-user context. Solo.io's agentgateway serves as the enforcement point for model policy, provider credentials, and inference-usage records. MCP connections are inventoried but not automatically proxied through agentgateway.

What This Means for Teams Adopting AI Coding Tools

The release identifies a real enterprise problem. As coding agents move out of centrally operated services and onto developer workstations, security and platform teams need governance that goes beyond the endpoint itself. They need to know what AI tools are installed, who is using them, what credentials they hold, and what policies apply to their behavior.

Agentdesktop's appeal depends on integration breadth and speed. AI tools change quickly. A governance layer must keep pace with configuration schemas, credential mechanisms, and sandbox semantics. The project's initial support covers major coding agents, but the ecosystem is expanding faster than any single project can track.

For teams already using Solo.io's cloud-native tools, agentdesktop extends an existing strategy to a part of the stack that has become increasingly important. For teams evaluating AI agent governance for the first time, it provides a concrete starting point: inventory what is running, apply policies in the language each tool understands, and link AI activity to a specific user and device. The open-source release gives organizations a way to evaluate the approach before committing to a vendor relationship.