Every control on this surface needs something first. Skarn needs a machine.

A Developer Endpoint Protection machine scan walks the disk on a schedule: "Detection runs on the endpoint, and file contents are never transmitted to GitGuardian's servers." With an optional history pass, its agent inventory parses agent transcripts on the endpoint too, rebuilding past MCP tool calls; an experimental activity option instead ships raw agent activity records to GitGuardian (GitGuardian docs, 2026-10-26, 2026-10-16). The tether is the account, the dashboard, and the detection server its AI Hooks call, not the scan location.

AI agent runtime protection works by "inspecting critical points in the agent loop where content enters or leaves the agent's reasoning," and on agents such as Claude Code, Codex CLI, and GitHub Copilot CLI it can "apply audit or block decisions at critical points in the agent workflow" (Microsoft Learn, 2026-10-09, Preview). The tether is the tenant, the licence, and - for local agent discovery - the commercial cloud: runtime protection needs "a Microsoft Defender for Endpoint Plan 2, Microsoft 365 E5, Microsoft Agent 365, or Microsoft 365 E7 license" and devices onboarded to Defender for Endpoint (Microsoft Learn, 2026-09-25).

Every prompt and tool call is "scanned and validated before the AI model processes it," and as an MCP server Prisma AIRS can also scan on demand, "not dependent on the real-time API intercept" (Palo Alto, 2025-11-19). Through Cortex Agentic Endpoint Security, hooks managed inside coding agents on developer endpoints send prompts, MCP tool calls, and network calls to Prisma AIRS, and the verdict comes from Prisma AIRS (Palo Alto docs, 2026-10-22). That is a deployment choice, not an omission: Prisma AIRS inspects what is sent to it, and finding and parsing the session stores already on disk is a different job.

The core scanner costs nothing, under a free license anyone can register for: all 251 detection rules, attack-chain correlation, the 0-100 session risk score, enforced redaction, and every output format. No trial window, no seat count, no card. Pro adds the paid controls - policy, baselines with per-entry provenance, audit evidence, and guard enforcement - and Team the organization around them.

No workspace and no endpoint enrolling into a vendor console. skarn assess scans every AI session on the machine with no account and no license; skarn check uses a free license file, fetched once and verified offline - an air-gapped machine never fetches it itself.

It scans locally and makes no network connection by default. Two commands transmit anything off the machine, and only when you run them: the optional signed rule-feed fetch and skarn license renew. No session content or secret the scan finds leaves the machine, and --offline disables all network access. skarn serve binds to 127.0.0.1.

An incomplete scan does not have to report green: --fail-on-scan-error exits non-zero when a source errored out of discovery or a session failed to parse, so a pipeline can refuse a scan that could not read everything.

One binary, one data path. The same engine audits the sessions already on disk across 13 assistants and backs the real-time pre-execution guard hook on 9 of them. There is no second product and no second place your session content can go.

C5 sets the criteria a cloud service provider is attested against by an auditor. The scan runs on your machine and makes no network call when it scans.

The European Commission's framework scores cloud services on data localisation, operational control, and legal jurisdiction. It does not score the scan, which runs on your machine and makes no network call when it scans.

The umbrella law asks operators of critical installations to document their resilience measures. Skarn's contribution is evidence: a local, auditable record of what AI coding sessions exposed, produced without anything leaving the operator's machines.

NIS-2 asks organisations to manage their cyber risk, including the security of how they develop software. Skarn produces documented SARIF 2.1.0 evidence of AI-session scanning, crosswalked to MITRE ATLAS and the OWASP Top 10 for LLM Applications 2025.

DORA asks financial entities to identify the weaknesses in their ICT systems. Credentials leaking through AI coding tools are one of them, and you can evidence it rather than assume it.

The AI Act sets rules for AI systems and the records kept about them. Where you keep a record that AI activity is monitored, --audit-log (Pro) appends a hash-chained record of each scan - timestamp, policy, finding counts, verdict, no secrets - and detects in-place edits and reordering of that history.