Agents

Note: The Agentic Security features are now available by request. If your organization wants a test drive, please contact your WitnessAI Administrator.

Download this document for Prerequisites and instructions:

WitnessAI_AgenticSecurity_How_to_Guide_2026.pdf

2.6 MiB

Agents Overview

The Agents console provides comprehensive visibility into AI agent activity across your organization. It captures and monitors how AI agents interact with MCP (Model Context Protocol) servers, the tools they invoke, the data they transfer, and the users driving those interactions.

Key Metrics

The Agents dashboard displays four primary metrics:

Agents: Total count of unique AI agents detected, with a count of newly discovered agents

MCP Servers: Total count of MCP servers accessed by agents, with a count of newly discovered servers

Tools Used: Total count of tool invocations across all agent activity

Data Transfer: Total volume of data transferred through agent interactions

Agent Ecosystem Visualization

The central visualization displays the agent ecosystem, showing the relationships between:

Groups: Organization departments or teams using agents

Agent Types: Categories of agents in use (OpenAI, Claude, VS Code, ChatGPT, Cursor, etc.)

MCP Servers: Individual MCP servers being accessed

The visualization provides an at-a-glance view of:

Distribution of agents across organizational groups

Types of agents deployed in your environment

MCP servers being accessed and their connection patterns

Relative usage volume indicated by circle size

Agent List

The right panel displays individual agent instances with:

Agent name and user attribution

Agent type classification

Activity indicator showing recent interaction volume

Each agent entry can be selected to view detailed activity history, tool usage patterns, and associated conversations.

Filtering and Navigation

Use the top navigation bar to filter by:

Time Range: View agent activity over last 7 days or custom periods

Agent Type: Filter by specific agent platforms

User: View agents associated with specific users

Group: Filter by organizational department

MCP Server: View agents accessing specific MCP servers

Insights: Access pre-configured analytics views

Agent Types

WitnessAI detects and classifies agents across three primary categories:

AI App Plugin Agents

User-facing agentic extensions on AI applications that operate on the client side or within the browser/desktop. These agents communicate directly with model providers via API and can access both remote tools (Jira, GitHub, Slack) and local tools on the user's machine (file access, terminal execution).

Examples: Claude, Cursor, ChatGPT with plugins

Characteristics:

Client-side operation

Direct API communication with LLM providers

Access to remote and local tools

User-initiated interactions

SaaS-Embedded AI Agents

Agents embedded within enterprise SaaS ecosystems that execute tasks through the vendor's internal orchestration layers. These agents operate within the SaaS environment with limited visibility from network inspection.

Examples: Microsoft Copilot Agents, Salesforce Agentforce

Characteristics:

Vendor-hosted execution

Internal orchestration

Access to organization data within SaaS platform

Typically low-code or no-code configuration

Custom AI Agents

Custom agents built on open-source frameworks and deployed on AWS, Azure, or local infrastructure. These agents autonomously plan, call APIs, and access enterprise data within self-hosted environments.

Examples: Agents built with Langchain, LlamaIndex

Characteristics:

Self-hosted deployment

Custom architecture

Variable security posture

Typically developed by R&D or IT automation teams

MCP Server Discovery

WitnessAI identifies and classifies MCP (Model Context Protocol) servers accessed by agents in your organization.

MCP Server Types

Remote MCP Servers: Publicly accessible MCP servers hosted on the internet that agents connect to for external tool access.

Private MCP Servers: Organization-hosted MCP servers running on internal infrastructure or cloud platforms.

MCP Server Metadata

For each discovered MCP server, WitnessAI captures:

Server hostname and IP address

Server name and version information

Vendor identification

Tool definitions and capabilities

Connection frequency and usage patterns

TLS certificate fingerprint for identity verification

Tool Visibility

WitnessAI provides runtime observability of:

MCP tool calls and invocations

Exposed APIs within MCP server connections

OS-level tool access

Configuration parameters

Data access patterns

User Attribution

Every agent invocation is correlated to a specific corporate identity, connecting human and agentic identities to provide accountability for who accessed which external tool and when.

Identity Correlation

WitnessAI maps:

Agent instances to individual users

User accounts to organizational groups

Tool access to responsible parties

Data transfers to initiating users

Getting Started

To view agent activity in your organization:

Navigate to Discovery in the left sidebar

Select the Agents tab in the top navigation

Review the agent ecosystem visualization and metrics

Select individual agents to view detailed activity

Use filters to narrow analysis by time, user, group, or server

Next Steps

Click the links below to learn more about monitoring agent activity and reviewing tool usage:

Conversations - View detailed conversation history with tool call cards and action chains

Alerts - Monitor policy violations triggered by agent activity

Agents Agents Overview Key Metrics Agent Ecosystem Visualization Agent List Filtering and Navigation Agent Types AI App Plugin Agents SaaS-Embedded AI Agents Custom AI Agents MCP Server Discovery MCP Server Types MCP Server Metadata Tool Visibility User Attribution Identity Correlation Getting Started Next Steps