SKARN
Install Compare Guides Editions Manual Standards Research About Book an assessment

AI coding-session security tools, compared by architecture

Skarn, GitGuardian, Microsoft Defender, Palo Alto Prisma AIRS, and Anthropic's Compliance API approach AI coding-session security from different places in the stack. The axis that decides which one fits is architectural: where it runs, what it requires before it runs, what network egress it needs, and which session surface it reads.

In one line: Skarn is the local-first, no-egress forensic layer for the AI-session surface the inline and cloud tools disclaim: local-disk session content, MCP and tool-call detail, and post-hoc attack-chain reconstruction with a session risk score. GitGuardian, Microsoft Defender, and Prisma AIRS are real-time prevention controls (on the endpoint, on the endpoint under a cloud tenant, and inline, respectively); Anthropic's Compliance API is a cloud activity feed for claude.ai data. They cover different moments and surfaces, and are complementary.

Comparisons current as of 2026-07-12. Every incumbent claim below is dated and links to that vendor's own source; see methodology and sources.

At a glance

Architectural and deployment properties only - where each tool runs, what it needs before it runs, and what it reads, not detection-accuracy benchmarks.

Architectural property Skarn GitGuardian Microsoft Defender Prisma AIRS Anthropic Compliance API
Runs locally on the developer machine Yes - single local binary Endpoint Protection: yes; the core ggshield engine sends file content to the GitGuardian API (GitGuardian docs, 2026-06-17) On the onboarded endpoint: yes; the licence, tenant, and Defender portal are cloud-side, and local AI agent discovery requires the commercial cloud (Microsoft, 2026-05-27, Preview) No - inline by design (Palo Alto, 2025-11-19) No - cloud API on api.anthropic.com (Anthropic docs, 2026-06-24)
Runs without a vendor account or tenant Yes - no vendor dashboard, workspace, or tenant; skarn assess needs no license and skarn check uses a free license file, verified offline No - "a GitGuardian business account with Endpoint Protection enabled" is the stated prerequisite, and the machine enrols into the GitGuardian dashboard (GitGuardian docs, 2026-06-30) No - devices onboarded to a Defender tenant, a Defender for Endpoint P2 / Microsoft 365 E5-class licence, and the Defender portal to read the result (Microsoft, 2026-05-27, Preview) No - the Prisma AIRS API is in the request path (Palo Alto, 2025-11-19) No - Claude Enterprise plans "excluding Public Sector organizations," and Claude Platform customers (Anthropic support, fetched 2026-07-12)
No network egress by default Yes - no network by default; the only optional egress is the signed maintained-feed fetch Endpoint Protection is metadata-only on egress; the ggshield core routes content to a cloud endpoint (GitGuardian, 2026-06-16) No - inventory and alerts surface in the Microsoft Defender portal (Microsoft, 2026-05-27, Preview) No - inline interception, cloud-backed (Palo Alto, 2025-11-19) No - cloud activity feed by definition (Anthropic docs, 2026-06-24)
Reads on-disk AI-session content (Claude Code, Cursor, Gemini, Codex, Copilot) Yes - 5 assistants Scans AI tool directories on the endpoint (GitGuardian, 2026-06-16) No - discovery surfaces agent and MCP-server presence; runtime protection inspects prompts and tool calls inline at hook points, not past on-disk sessions (Microsoft, 2026-05-27, Preview) No - inline, not past on-disk sessions (Palo Alto, 2025-11-19) No - content endpoints serve claude.ai data only (Anthropic docs, 2026-06-24)
Covers MCP and tool-call detail from sessions Yes - mcps / tools / cmds recall over parsed sessions Not documented in the Endpoint Protection scope (GitGuardian, 2026-06-16) Discovers MCP server configurations and inspects tool calls inline at agent hook points, not as post-hoc detail across past sessions (Microsoft, 2026-05-27, Preview) Scanned inline at the gateway, not as post-hoc detail across past sessions (Palo Alto, 2025-11-19) Excluded - no record of MCP traffic or tool calls (General Analysis audit, 2026-05-01)
Reconstructs attack chains post-hoc with a 0-100 risk score Yes - ATLAS-aligned chains + session risk score No documented attack-chain or behavioral correlation as of 2026-06-16 (GitGuardian, 2026-06-16) No post-hoc reconstruction over past sessions; live detections raise a prompt-injection alert correlated into incidents in the portal (Microsoft, 2026-05-27, Preview) Inline block / allow at the request boundary, not post-hoc chains (Palo Alto, 2025-11-19) No - records resource lifecycle, not what Claude did in a session (General Analysis audit, 2026-05-01)
Deployment model Local post-hoc forensic over past on-disk sessions Endpoint agent (local scan, metadata egress) plus cloud-API core engine Cloud-managed endpoint agent: discovery plus inline runtime protection on onboarded devices, read in the Defender portal Inline real-time interception in the model request and response cycle Cloud audit and activity feed for claude.ai data

Architectural and deployment comparison, current as of 2026-07-12. Cells compare only on where each tool runs, what it requires, and what it reads, not on secret-detection accuracy. Each incumbent cell links to that vendor's own dated source. Microsoft's local AI agent discovery and runtime protection are Preview products and are dated as such.

The tools, in detail

Skarn Best for: local, no-egress AI-session forensics and real-time pre-execution prevention across a team

Skarn is an AI coding session security scanner that reads the local session transcripts AI coding assistants already write to disk, across Claude Code, Codex CLI, Cursor, Gemini CLI, and GitHub Copilot, from a single binary. It pulls leaked credentials out of past sessions redacted, scored, and attributed to the exact session, using 248 built-in rules covering 200+ credential types. Past keys, it correlates multi-stage attacks - a prompt injection that drives a secret read and then an exfiltration - into an attack chain across MITRE ATLAS tactic-aligned stages, and assigns a 0-100 risk score per session and per team for dashboards or a CI gate. Every finding is crosswalked against MITRE ATLAS, the OWASP Top 10 for LLM Applications 2025, and CWE, emitted as SARIF 2.1.0 taxonomies for a SIEM, ASPM, or GitHub code scanning. Beyond the audit, a real-time pre-execution guard hook for Claude Code, Cursor, Codex CLI, and GitHub Copilot can refuse a leaked credential before the tool call runs. It makes no network calls by default and redaction is enforced by a gate, which is what gets it past data-residency review.

Strengths

  • Local-first, no network egress by default; redaction enforced by a gate
  • Reconstructs attack chains post-hoc, not just individual secrets
  • Crosswalks findings to MITRE ATLAS, OWASP LLM Top 10 2025, and CWE in SARIF
  • Five assistants from one binary, on macOS, Windows, and Linux
  • SARIF / JSON output and CI gating by severity or risk score

Deployment model

  • The scan is post-hoc over sessions already on disk; real-time prevention is a separate pre-execution guard on Claude Code, Cursor, Codex CLI, and GitHub Copilot
  • Does not scan git repositories - pair it with a git scanner

GitGuardian Best for: real-time secret prevention on the developer endpoint

GitGuardian approaches the AI-session surface from real-time prevention. Its Developer Endpoint Protection, announced 2026-06-16, scans AI tool directories and log files on the developer machine; GitGuardian states that "all scanning happens locally on the endpoint," credentials "are never sent to GitGuardian in clear text," and "only structured metadata leaves the endpoint." The precondition is an account: the documented prerequisite is "a GitGuardian business account with Endpoint Protection enabled," and the enrolled machine "shows up under Endpoint protection - Endpoints in the GitGuardian dashboard" (GitGuardian docs, last updated 2026-06-30). Separately, the core ggshield secret-detection engine used by its hooks requires a GitGuardian API key and routes file content to the GitGuardian API for analysis (GitGuardian docs, last updated 2026-06-17); a self-hosted instance is selectable, and detection still routes through a GitGuardian API endpoint rather than a local-only engine. As of 2026-06-16 the published Endpoint Protection scope - credential inventory, honeytokens, and SIEM/SOAR forwarding - documents no attack-chain or behavioral correlation. The architectural contrast to Skarn is the deployment model (a managed service, with an account, a dashboard, and a cloud-API core detection engine), not a local-scan gap: Endpoint Protection does scan locally.

Strengths

  • Real-time prevention focus; mature, broad secret-detection engine
  • Endpoint Protection scans locally on the endpoint with metadata-only egress
  • Fits teams already standardized on GitGuardian, with SIEM/SOAR forwarding

Architectural contrast

  • Requires a GitGuardian business account with Endpoint Protection enabled; the endpoint enrols into the GitGuardian dashboard (docs, 2026-06-30)
  • The core ggshield detection engine routes file content to a GitGuardian API endpoint (docs, 2026-06-17)
  • No documented attack-chain / behavioral / MITRE ATLAS correlation in the Endpoint Protection scope (2026-06-16)

Microsoft Defender for Endpoint Best for: Microsoft-tenant fleets that want AI-agent inventory and inline prompt-injection blocking in the Defender portal

Microsoft has moved onto this surface from the endpoint-management side, in Preview as of 2026-05-27. Local AI agent discovery "automatically discovers supported local AI agents and MCP server configurations on onboarded devices" - Claude Code, Codex CLI, Gemini CLI, GitHub Copilot CLI, Cursor and others - and surfaces them in the Microsoft Defender portal; Microsoft scopes it precisely, stating it "provides discovery and investigation capabilities only." Alongside it, AI agent runtime protection inspects "user prompts, tool requests before execution, and tool responses after execution" and can "audit or block activity at each supported event point," using the same vendor hook interfaces a local guard uses. So Defender does inspect and block locally, and the honest contrast is not capability but precondition: it requires devices onboarded to a Defender tenant, a Defender for Endpoint Plan 2 or Microsoft 365 E5-class licence, and the Defender portal to read the result - and for local AI agent discovery, Microsoft states that "your environment is in the commercial cloud. Sovereign and national clouds aren't supported." What it does not do is reconstruct what already accumulated in the sessions on disk.

Strengths

  • Inline prompt-injection detection and blocking at the agent's own hook points, on Claude Code, Codex CLI, and GitHub Copilot
  • Inventory of local AI agents and MCP server configurations across an onboarded fleet
  • Alerts land in the Defender portal and correlate into incidents in a SOC workflow teams already run

Architectural contrast

  • Local AI agent discovery requires an environment in the commercial cloud; sovereign and national clouds are not supported (Microsoft, 2026-05-27)
  • Requires a Defender tenant, onboarded devices, an E5-class licence, and the Defender portal (2026-05-27)
  • Inline at the hook, not a post-hoc reconstruction with a 0-100 risk score over the sessions already on disk
  • Both capabilities are Preview: "a prereleased product which may be substantially modified"

Palo Alto Prisma AIRS Best for: inline, real-time interception at an AI gateway

Prisma AIRS secures AI coding agents inline. In Palo Alto's documented Claude Code integration (2025-11-19), "every user prompt and tool call is automatically scanned and validated before the AI model processes it," functioning as "a deterministic security control layer within the model's request/response cycle," with data flowing through Prisma AIRS for analysis before reaching the model. The Prisma AIRS 3.0 launch (2026-03-23) uses the "vibe coding agents" category language for endpoint agents running on developer systems. This is a deployment-model contrast to Skarn, not a feature gap: Prisma AIRS is inline real-time interception, while Skarn is local post-hoc forensic reconstruction across past on-disk sessions. The two address different moments - blocking at the request boundary versus auditing what already accumulated.

Strengths

  • Inline, real-time interception of prompts and tool calls before the model
  • Enterprise platform, brand, and distribution at scale
  • Owns resonant "vibe coding agent security" category language

Architectural contrast

  • Inline / cloud deployment; not a local, no-egress control
  • Real-time block / allow at the request boundary, not post-hoc chain reconstruction across past sessions

Anthropic Claude Compliance API Best for: routing claude.ai organization activity into a SIEM

Anthropic's Compliance API gives programmatic access to claude.ai organization activity for DLP and SIEM. Anthropic's documentation states the content endpoints "serve claude.ai data only," and the audit-log export has "no access to chat, file, or project content." An independent audit by General Analysis (2026-05-01) documents the coverage boundary in detail: "No record of MCP server traffic," "Nothing about what tools Claude called or what those tools returned," and "It does not cover Claude Cowork." Those exclusions are exactly the local-disk and tool-call session surface Skarn reads. The contrast is architectural: a cloud audit feed for claude.ai data versus a local scanner of on-disk session content. The exclusion wording is the vendor and the audit disclaiming that surface, dated.

Strengths

  • First-party feed of claude.ai organization activity into existing DLP / SIEM
  • Broad partner-integration ecosystem for compliance teams
  • The integration a buyer may "already pay for" on an enterprise plan

Architectural contrast

  • Content endpoints serve claude.ai data only (Anthropic docs, 2026-06-24)
  • Available to Claude Enterprise plans "excluding Public Sector organizations," and Claude Platform customers (Anthropic support, fetched 2026-07-12)
  • Excludes MCP traffic, tool-call detail, and Claude Cowork per the General Analysis audit (2026-05-01)

Different surface, not compared above: git-repository secret scanners scan git repositories and commit history, not AI-session content, and have no awareness of AI session structure (MCP calls, tool invocations, multi-turn attack progression) - they are complementary to a session scanner, not competing on this axis.

Which one should you use?

Pick by the moment and surface you are worried about, then combine.

You want to audit what has already leaked into local AI sessions across a team, with no egress.
Use Skarn. It reads the on-disk history across 5 assistants locally, reconstructs attack chains, and gives a risk score per session and per team for a report or a CI gate, making no network calls by default.
You want real-time secret prevention on the developer machine.
GitGuardian's Developer Endpoint Protection and ggshield hooks are a real-time prevention control. Pair them with a local post-hoc audit of the session history already on disk, which a live control does not reconstruct.
You run a Microsoft tenant and want AI-agent inventory and inline blocking in the Defender portal.
Microsoft Defender for Endpoint does both, in Preview as of 2026-05-27. Check two preconditions first: local AI agent discovery requires an environment in the commercial cloud (sovereign and national clouds are not supported), and both capabilities need onboarded devices and an E5-class licence. If you are in a sovereign cloud, air-gapped, or outside that licence, a local binary is the control that still runs.
You want an inline gateway that blocks prompts and tool calls before the model.
Palo Alto Prisma AIRS is inline real-time interception. It is a different deployment model from a local post-hoc forensic scan; teams that want both run a local audit alongside it.
You want claude.ai organization activity in your SIEM.
Anthropic's Compliance API is the first-party feed. Note it serves claude.ai data only and, per the General Analysis audit, excludes MCP, tool-call detail, and Cowork - pair it with a local-disk session scanner for that surface.
You want to scan your repositories.
A git-repository secret scanner for fast pre-commit and CI. It will not cover AI sessions - run an AI-session scanner alongside it.

Methodology and sources

We compare only on the architectural and deployment axis - where each tool runs, what it requires before it runs, what egress it needs, and what session surface it reads - because those properties are structural to each product's design. Every "no" or "not covered" cell links to the named vendor's own dated source. Comparisons current as of 2026-07-12.

  • GitGuardian Developer Endpoint Protection (local scan, metadata-only egress, AI tool directories): blog.gitguardian.com, published 2026-06-16.
  • GitGuardian Developer Endpoint Protection prerequisites (business account, dashboard enrolment): docs.gitguardian.com, last updated 2026-06-30.
  • GitGuardian core ggshield engine cloud-API dependency: docs.gitguardian.com, last updated 2026-06-17.
  • Microsoft Defender for Endpoint, local AI agent discovery (commercial cloud only, licence, portal, discovery-and-investigation scope): learn.microsoft.com, Preview, 2026-05-27.
  • Microsoft Defender for Endpoint, supported local AI agents and MCP-server discovery: learn.microsoft.com, Preview, 2026-05-27.
  • Microsoft Defender for Endpoint, AI agent runtime protection (inline inspection and blocking at agent hook points): learn.microsoft.com, Preview, 2026-05-27.
  • Palo Alto Prisma AIRS inline interception for Claude Code: paloaltonetworks.com, published 2025-11-19.
  • Palo Alto Prisma AIRS 3.0 "vibe coding agents" category language: paloaltonetworks.com, published 2026-03-23.
  • Anthropic Claude Compliance API content scope (claude.ai data only): platform.claude.com, fetched 2026-06-24.
  • Anthropic Claude Compliance API eligibility (Enterprise plans, excluding Public Sector organizations): support.claude.com, fetched 2026-07-12.
  • Independent audit of the Compliance API coverage gaps (MCP, tool-call detail, Cowork): generalanalysis.com, General Analysis, 2026-05-01.
  • Skarn architectural claims (local-first, no egress, attack-chain, risk score, standards crosswalk): the Skarn manual and the standards crosswalk, as of 2026-07-12.

Attribution: the "claude.ai data only" wording is Anthropic's own; the explicit MCP, tool-call, and Cowork exclusion wording is from the independent General Analysis audit. GitGuardian's "no attack-chain" cell is an absence noted from the documented Endpoint Protection scope as of 2026-06-16, not a vendor statement of non-coverage; GitGuardian's Endpoint Protection does scan locally, and Microsoft Defender does inspect and block locally at agent hook points - the cells above are about preconditions and surfaces, not about whether these products can run on an endpoint. Microsoft's commercial-cloud prerequisite is documented for local AI agent discovery specifically, and both Defender capabilities are Preview. The Prisma AIRS cell is a deployment-model contrast, not a missing feature.

See your own AI-session exposure in 30 minutes

A scoped, consent-first assessment run with you on a developer's machine. Nothing leaves the laptop - you watch it run and keep the redacted report.

Book an exposure assessment How Skarn works

Runs on macOS, Windows, and Linux, on both Intel and ARM.