Shadow AI Governance for AI Apps,
Coding Agents, and MCP Servers
Bifrost is an enterprise AI gateway that applies one policy to every model and tool request, and Bifrost Edge extends that policy to company devices so security and IT teams can find, approve, and guard shadow AI.
[ PERFORMANCE AT A GLANCE ]
One Gateway behind Every Endpoint AI Request
[ AI APPS ON COMPANY DEVICES ]
ChatGPT
Claude Desktop
Claude Code
Cursor
GitHub Copilot
Codex CLI
Gemini CLI
Windsurf
Perplexity
Microsoft CopilotChatGPTClaude DesktopClaude CodeCursorGitHub CopilotCodex CLIGemini CLIWindsurfPerplexityMicrosoft CopilotChatGPTClaude DesktopClaude CodeCursorGitHub CopilotCodex CLIGemini CLIWindsurfPerplexityMicrosoft Copilot[ THE PROBLEM ]
Assess Shadow AI Risks in the Workplace
Map the desktop and browser AI tools that send prompts to providers without policy checks.
Find AI apps installed outside central records
Claude Desktop, ChatGPT, Cursor, and coding agents are set up per device, so no central record shows which tools run where.
Surface MCP servers configured inside desktop tools
MCP servers can read files, call APIs, and take actions, and their configuration lives inside each AI app, where endpoint and network tools do not report it.
Check prompts before they leave the device
A prompt typed into chatgpt.com or sent by a coding agent goes directly to the provider, so PII and credentials in it are never checked against a guardrail.
Attribute AI spend to teams and budgets
Personal keys and subscriptions sit outside company billing, so AI spend cannot be planned or allocated by team or budget.
[ THE QUESTIONS ]
How to Detect Shadow AI and Bring It under Policy
Each question below maps to a control in the Bifrost Gateway or in Bifrost Edge, the governance layer that extends the Gateway to company devices.
| Question your team is asking | How Bifrost answers it | Capability |
|---|---|---|
| Which AI apps are in use on company devices? | Edge discovers AI apps on each device and lists them fleet-wide for review | App governance |
| Which MCP servers are connected to those apps? | Edge reads each supported app's MCP configuration and builds a deduplicated inventory | MCP governance |
| Can we block an app or MCP server we have not approved? | A denied item is stopped on the device before data leaves the device | Approvals |
| What happens to a new app before anyone reviews it? | Pending items keep working by default; one setting blocks them until approved | Edge settings |
| Can we stop PII and secrets leaving through browser AI? | Gateway guardrails evaluate prompts from supported apps before they reach a model | Guardrails on Edge traffic |
| Can we see which team or key a request used and what it cost? | SSO sign-in links traffic to a virtual key; request logs record model, tokens, cost, and latency | Request logs |
| Can we cap AI spend per person or team? | Access profiles issue per-user virtual keys with their own budgets and rate limits | Access profiles |
| Does anyone need to paste keys or change app settings? | Users sign in once through SSO; the managed configuration holds only the Bifrost URL | How Edge works |
| Does this replace endpoint or network security tools? | Those products stay in place; Edge handles AI traffic only | Outside gateway scope |
[ HOW IT WORKS ]
How Bifrost Works with AI Apps, Browser AI, and Coding Agents
The Bifrost Gateway is the control plane where policy lives, and Bifrost Edge runs on each company device, routes supported AI traffic to the Gateway, and enforces app and MCP decisions on the device.
Edge + Gateway
Keep existing tools and sign in once
People sign in once with the company identity provider and keep working as before.
- Same apps, browser, and terminal
- No base URL or SDK changes per app
- No API keys stored on the device
- Active virtual key and budget shown in the menu bar or tray
Inventory, approve, and enforce from one console
Security and IT teams manage the fleet from the Bifrost console.
- Inventory of AI apps and MCP servers per device
- Allow and deny decisions enforced on the device
- Existing guardrail profiles applied to endpoint prompts
- Spend attributed to teams, keys, and models
[ CORE CAPABILITIES ]
Shadow AI Detection, Approvals, and Guardrails on Every Device
Each capability is configured once in Bifrost and reaches enrolled devices at their next check-in.
Allow or block AI apps by policy
App governance enforces the approved-app list on each device and stops other apps before data leaves it.
Central app policyInventory and deny MCP servers fleet-wide
MCP governance covers Claude Code, Claude Desktop, Gemini CLI, OpenCode, Codex, and Cursor, with denials enforced on the device.
6 AI apps coveredReview new apps and servers in one approval queue
The Approvals dashboard deduplicates entries across the fleet, so one decision applies everywhere, with bulk actions.
Pending, approved, deniedApply AI guardrails to every prompt
Existing PII, secrets, and content-safety checks cover Edge traffic with no device setup, configured once in Guardrails.
Same rules as the GatewayIssue per-user virtual keys through SSO
Access profiles set permitted models, budgets, and rate limits for each user after identity provider sign-in.
Profile-managed keysSee each enrolled device and its AI tools
The Devices dashboard shows owner, platform, installed apps, MCP servers, and last check-in, filterable by status.
Per-device detail[ SETUP ]
Three Steps to Govern AI Apps on Every Company Device
Edge needs no per-app configuration or SDK changes and runs on macOS, Windows, and Linux.
Prepare identity and access in Bifrost
Configure an identity provider, roles, and an access profile in the Enterprise Gateway so each Edge user resolves to an active virtual key, as described in Prepare Bifrost.
Configure the Edge certificate and fleet settings
Generate or upload the certificate authority under Edge Control, then set the agent sync interval (default 60 seconds) and whether pending apps and MCP servers are allowed.
Deploy through MDM and verify traffic
Push the agent with a managed config.json that points devices at your Bifrost, then confirm a request from a supported app appears in Bifrost.
[ COMPARISON ]
Workplace AI Tools Alone vs. Workplace AI Tools + Bifrost
| Capability | Workplace AI tools alone | Workplace AI tools + Bifrost |
|---|---|---|
| App inventory | Gathered per device by survey or scan | Fleet-wide catalog of discovered AI apps |
| MCP server visibility | Stored in each app's local configuration | Deduplicated inventory with each server's tools |
| Allow or deny | Written acceptable use policy | Decisions enforced on the device |
| Prompt inspection | Set by each AI vendor | Gateway guardrails for PII, secrets, and content safety |
| Credentials | Personal keys or accounts | SSO sign-in and profile-managed virtual keys |
| Spend control | Per-seat or per-account billing | Budgets and rate limits per user or team |
| Rollout | Manual setup on each device | Install through existing MDM |
[ USE CASES ]
Where Security and IT Teams Use Bifrost for Shadow AI
Build an AI app inventory for security reviews
Security teams use the Devices and Approvals dashboards to see which AI tools and MCP servers exist on the fleet before revising an AI acceptable use policy.
Roll out approved AI tools across managed devices
IT teams approve the AI apps the company licenses and apply the list to every managed device, so people know which tools are supported.
Govern AI coding agents on developer workstations
Platform teams route Claude Code, Codex CLI, and OpenCode on coding agents on developer workstations through per-developer virtual keys, alongside CLI agents already configured against the Gateway.
Keep sensitive data inside policy in regulated industries
Teams in financial services and healthcare apply their production PII and secrets guardrails to browser AI.
[ GOVERNANCE & COMPLIANCE ]
Built for Enterprises with Strict Security Requirements
Multiple Fortune 500 companies run Bifrost in production for mission-critical AI workloads that require top-tier performance, scalability, and reliability. Bifrost Enterprise is air-gapped by default, and endpoint AI governance keeps prompts from company devices in that environment.
SOC 2 Type II · ISO 27001 · HIPAA · GDPR
Control who approves apps and changes settings
RBAC controls who can approve apps, deny MCP servers, and change Edge settings, with roles mapped from identity provider claims.
Record every administrative change
Audit logs record administrative activity as signed entries showing who changed what and when, with export for downstream review.
Mask sensitive values in logs and exports
Redaction applies separately to live traffic, Bifrost logs, and trace exports, so sensitive values can be masked in stored records.
Run the gateway inside your VPC
The Gateway that Edge connects to runs in the customer VPC or on premises, so endpoint AI traffic stays in company infrastructure.
[ GO DEEPER ]
Related Bifrost Resources
Bifrost Edge
The endpoint layer that brings desktop, browser, and agent AI onto the Gateway.
SecurityLLM guardrails with Bifrost
Guardrail rules and profiles that Edge applies to endpoint prompts.
Access ControlVirtual keys and budgets
Per-team and per-user access, budgets, and rate limits for AI traffic.
SecurityHow CISOs get end-to-end AI governance
A security-leader view of visibility, approval, and enforcement.
[ WHAT'S NEXT ]
Explore Bifrost Resources
Continue with governance, guardrails, MCP, and the rest of the resource library.
[ BIFROST FEATURES ]
Open Source & Enterprise
Everything you need to run AI in production, from free open source to enterprise-grade features.
01 Governance
SAML support for SSO and Role-based access control and policy enforcement for team collaboration.
02 Adaptive Load Balancing
Automatically optimizes traffic distribution across provider keys and models based on real-time performance metrics.
03 Cluster Mode
High availability deployment with automatic failover and load balancing. Peer-to-peer clustering where every instance is equal.
04 Alerts
Real-time notifications for budget limits, failures, and performance issues on Email, Slack, PagerDuty, Teams, Webhook and more.
05 Log Exports
Export and analyze request logs, traces, and telemetry data from Bifrost with enterprise-grade data export capabilities for compliance, monitoring, and analytics.
06 Audit Logs
Comprehensive logging and audit trails for compliance and debugging.
07 Vault Support
Secure API key management with HashiCorp Vault, AWS Secrets Manager, Google Secret Manager, and Azure Key Vault integration.
08 VPC Deployment
Deploy Bifrost within your private cloud infrastructure with VPC isolation, custom networking, and enhanced security controls.
09 Guardrails
Automatically detect and block unsafe model outputs with real-time policy enforcement and content moderation across all agents.
[ SHIP RELIABLE AI ]
Try Bifrost Enterprise with a 14-day Free Trial
Drop-in replacement for any AI SDK
Change just one line of code. Works with OpenAI, Anthropic, Vercel AI SDK, LangChain, and more.
[ FAQ ]
Frequently Asked Questions
Shadow AI is the use of AI apps, browser AI, coding agents, and MCP servers that an organization's security and IT teams have not approved and cannot see. Bifrost addresses it by routing that traffic from company devices through Bifrost Edge to the Bifrost Gateway, where it is inventoried, approved or denied, and checked against guardrails.
Unapproved AI tools can carry customer data, credentials, or source code to providers with no guardrail, log, or budget in between. Bifrost applies the organization's guardrails, request logging, and budgets to that traffic and denies unapproved MCP servers on the device. The detection guide covers the risks in more depth.
ChatGPT counts as shadow AI when it is used for work outside the organization's approved tools and policies. Bifrost Edge governs ChatGPT on chatgpt.com and in the desktop app, so an approved deployment carries the same guardrails and request logging as other requests routed through the Bifrost Gateway.
Bifrost lets teams approve the AI tools they trust and route them through the Gateway, so people keep the tools they find useful, now under policy. One Edge setting decides whether newly discovered apps stay usable while pending or are blocked until reviewed.
Bifrost Gateway overhead is about 11 microseconds per request at 5,000 RPS on a t3.xlarge with a 100% success rate in published benchmarks. Edge intercepts only traffic for configured AI domains, so other traffic on the device is not inspected or routed.
Bifrost Edge installs through the MDM platform a company already runs, and each user signs in once through SSO. The Gateway needs an identity provider, roles, and an access profile prepared first; direct install covers pilot devices.
Bifrost Edge requires the Enterprise Gateway and is priced per endpoint, while the open-source Gateway is free for self-hosted use under Apache 2.0. Edge is in early access, and guardrails, RBAC, access profiles, and audit logs are Enterprise features covered by the 14-day trial.