AI coding-session security tools, compared by architecture

At a glance

Architectural and deployment properties only: where each tool runs, what it needs before it runs, what it reads, and what it covers.

Architectural and deployment comparison, current as of 2026-10-26. Cells compare only on where each tool runs, what it requires, what it reads, and what it covers. Skarn's own precision is measured separately, and published with its method, for secret detection and attack-chain correlation. What the session logs actually contain is measured in the session secret-exposure teardown, and the scanning guide shows where each assistant keeps them. Each incumbent cell links to that vendor's own dated source. Microsoft's AI agent runtime protection, and local AI agent discovery on macOS, are Preview and are marked as such.

The tools, in detail

A different surface, left out of the table: git-repository secret scanners scan git repositories and commit history and have no awareness of AI session structure (MCP calls, tool invocations, multi-turn attack progression). They complement a session scanner.

Skarn vs gitleaks and trufflehog

A different axis from the table above: not where the tool runs, but which surface it reads. gitleaks and trufflehog are the two tools most often suggested for this problem, and they were built for a different one.

Both are good at what they were built for. gitleaks and trufflehog scan git repositories and commit history for secrets, and trufflehog additionally verifies many credential types against the issuing service. Both can also be pointed at a directory of files, so "they only read git" is not the distinction.

The distinction is that a credential pasted into an AI chat and never committed never enters git, and the file it does land in is not a file either tool knows to look for. Finding it takes four things a git scanner does not do: discovering each assistant's session store, parsing the format that store is in, attributing the hit back to a session and a message, and correlating a leak with the prompt injection that caused it.

Current as of 2026-09-04, from each project's own README and repository metadata; both are linked under methodology and sources. The rows that read "no session-format parsing" and "No" for store discovery and chain correlation are absences noted from the documented command surface of each tool, not statements by either project that it does not cover this. Not a replacement in either direction: a team that ships code needs a git secret scanner, and a team whose developers use AI assistants needs something that reads the session stores. Run both. The paths a session scan covers are listed on the session-store reference page.

Which one should you use?

Pick by the moment and surface you are worried about, then combine.

You want to audit what has already leaked into local AI sessions across a team, with no egress.

Use Skarn. It reads the on-disk history across 13 assistants locally, reconstructs attack chains, and gives a risk score per session and per team for a report or a CI gate, making no network calls by default.

You want real-time secret prevention on the developer machine.

GitGuardian's AI Hooks are a real-time prevention control, and its Developer Endpoint Protection adds a scheduled scan of the secrets already on the machine and an inventory that can rebuild past MCP tool calls. Pair them with a local post-hoc audit of the session history already on disk that correlates attack chains across it, which GitGuardian's documentation does not describe.

You run a Microsoft tenant and want AI-agent inventory and inline blocking in the Defender portal.

Microsoft Defender for Endpoint does both; runtime protection is in Preview as of 2026-10-09. Check two preconditions first: local AI agent discovery requires an environment in the commercial cloud (sovereign and national clouds are not supported), and both capabilities need onboarded devices and a Defender licence (Defender for Endpoint Plan 2 for discovery; Plan 2, Microsoft 365 E5, Microsoft Agent 365, or Microsoft 365 E7 for runtime protection). If you are in a sovereign cloud, air-gapped, or outside those licences, a local binary is the control that still runs.

You want an inline gateway that blocks prompts and tool calls before the model.

Palo Alto Prisma AIRS is inline real-time interception, at a gateway or, through Cortex AES, at hooks in the coding agents on developer endpoints, and it can also scan on demand as an MCP server. It is a different deployment model from a local post-hoc forensic scan; teams that want both run a local audit alongside it.

You want Claude Enterprise activity and Claude Code transcripts in your SIEM.

Anthropic's Compliance API is the first-party feed. Its local session endpoints return what reached the Claude API from Claude Enterprise sign-ins - not the on-disk record, not Claude Code cloud sessions, and not Claude Code sessions on a Console API key or a third-party cloud - so pair it with a local-disk session scanner for that surface and for every other assistant.

You want to scan your repositories.

gitleaks or trufflehog, for fast pre-commit and CI over git history. Neither discovers or parses the AI session stores, so run an AI-session scanner alongside; the two surfaces are set out in Skarn vs gitleaks and trufflehog above.

Methodology and sources

We compare only on the architectural and deployment axis - where each tool runs, what it requires before it runs, what egress it needs, and what session surface it reads - because those properties are structural to each product's design. Every "no" or "not covered" cell links to the named vendor's own dated source. The incumbent comparison is current as of 2026-10-26; the gitleaks and trufflehog section was checked separately against each project's own repository on 2026-09-04.

• GitGuardian Developer Endpoint Protection (AI tool directories and log files): blog.gitguardian.com, published 2026-06-16.
• GitGuardian Endpoint Protection data handling (machine scans detect on the endpoint and check validity directly with providers; AI Hooks send the scanned content to the GitGuardian API): docs.gitguardian.com, last updated 2026-10-26.
• GitGuardian AI agent and MCP inventory (MCP tool calls rebuilt from agent transcripts, parsed on the endpoint): docs.gitguardian.com, last updated 2026-10-16.
• GitGuardian Developer Endpoint Protection prerequisites (business account, dashboard enrolment) and plan availability (Growth or Enterprise): docs.gitguardian.com and the Endpoint Protection overview, both last updated 2026-10-16.
• GitGuardian core ggshield engine API dependency (GitGuardian SaaS or an on-premise instance): docs.gitguardian.com, last updated 2026-10-16.
• Microsoft Defender for Endpoint, local AI agent discovery (commercial cloud only, Defender for Endpoint Plan 2 licence, portal): learn.microsoft.com, last updated 2026-10-07.
• Microsoft Defender for Endpoint, local AI agent and MCP-server discovery (macOS in preview): learn.microsoft.com, last updated 2026-10-09.
• Microsoft Defender for Endpoint, AI agent runtime protection (inline inspection and blocking at agent hook points, network inspection): learn.microsoft.com, Preview, last updated 2026-10-09.
• Microsoft Defender for Endpoint, AI agent runtime protection prerequisites (licences, onboarded Windows devices): learn.microsoft.com, last updated 2026-09-25.
• Palo Alto Prisma AIRS inline interception for Claude Code, and on-demand scanning as an MCP server: paloaltonetworks.com, published 2025-11-19.
• Palo Alto Prisma AIRS integration with Cortex Agentic Endpoint Security (AIRS hooks in coding agents on developer endpoints): docs.paloaltonetworks.com, updated 2026-10-22.
• Palo Alto Prisma AIRS 3.0 "vibe coding agents" category language: paloaltonetworks.com, published 2026-03-23.
• Anthropic Claude Compliance API overview (content endpoints serve Claude Enterprise data only): platform.claude.com, fetched 2026-10-26.
• Anthropic Claude Compliance API session transcripts (Claude Code and Cowork local sessions, server-side capture, exclusions): platform.claude.com, fetched 2026-10-26.
• Anthropic Claude Compliance API eligibility (Enterprise plan organizations and Claude Platform customers in Claude chats; a separate Compliance API for dedicated government deployments): support.claude.com, fetched 2026-10-26.
• gitleaks command surface (git for repositories and history, dir for directories and files, pre-commit hook) and MIT licence: github.com/gitleaks/gitleaks, README and repository metadata, fetched 2026-09-04.
• trufflehog command surface (git, github, filesystem and other sources, --results=verified live credential verification) and AGPL-3.0 licence: github.com/trufflesecurity/trufflehog, README and repository metadata, fetched 2026-09-04.
• Skarn architectural claims (local-first, no egress, attack-chain, risk score, standards crosswalk): the Skarn manual and the standards crosswalk, as of 2026-07-12.

Attribution: every Compliance API sentence above is Anthropic's own, from the pages fetched 2026-10-26; earlier versions of this page cited an independent audit for MCP, tool-call, and Cowork exclusions that Anthropic's documentation no longer supports, and that citation is withdrawn. Until 2026-10-26 this page also quoted a Public Sector exclusion from Anthropic's eligibility article, which the article no longer carries, and an exclusion of local sessions in organizations with HIPAA readiness; Anthropic's sessions page now states that in those organizations the local session endpoints return Cowork and Claude Code sessions, stored for at most 30 days. GitGuardian's "no attack-chain" cell is an absence noted from the Endpoint Protection documentation as of 2026-10-26, not a vendor statement of non-coverage; GitGuardian's Endpoint Protection does scan locally and parses agent transcripts on the endpoint, and Microsoft Defender does inspect and block locally at agent hook points - the cells above are about preconditions and surfaces, not about whether these products can run on an endpoint. Microsoft's commercial-cloud prerequisite is documented for local AI agent discovery specifically; Defender's runtime protection is Preview, and so is local AI agent discovery on macOS. The Prisma AIRS cell is a deployment-model contrast, not a missing feature. Where a cell says a capability is not documented, that is an absence in the vendor's cited documentation, not a statement that the product cannot do it.