Skip to content
Monitor

See Every AI Tool, Session, Token, and Dollar

Real-time visibility across the fleet: which AI tools run where, what each session actually did, where the data went, and what all of it costs.

Book a DemoStart Free Trial
What You Get

Six Capabilities, One Telemetry Stream

AI Tool Discovery

Five independent detection layers identify AI coding tools by name, by network destination, and by behavior - catching tools that have no signature yet.

  • 48 tools by name
  • 115 AI service endpoints
  • Behavioral heuristics
  • WSL coverage
Learn more

Session Intelligence

Full Claude Code session reconstruction: prompts, responses, tool calls, file operations, shell commands, MCP connections, and per-turn cost.

  • Conversation replay
  • Shell command log
  • Subagent mapping
  • Cost per turn
Learn more

Live Floor

Every active AI session across the fleet in real time - who is running what, in which repo, on which model, with live token burn.

  • Sub-second streaming
  • Per-repo context
  • Model visibility
  • Live token burn

Cost & Usage Analytics

Per-developer, per-team, per-model token and cost tracking with 30-day trends, budget alerts, and chargeback-ready exports.

  • Model-aware pricing
  • Budget thresholds
  • Adoption metrics
  • Finance exports
Learn more

Local AI Detection

Self-hosted inference that never touches the corporate network is still inventoried - model name, size, quantization, and last-used time.

  • Ollama
  • LM Studio
  • vLLM
  • llama.cpp +3 more

Data Egress Monitoring

Every AI-related outbound connection classified into five categories, with connection history and reclassification.

  • Shadow AI flagging
  • MCP destinations
  • Reclassification
  • Policy integration
Learn more
Detection Detail

The Five Layers

DiscoveryFilesystem scanning for config directories, VS Code and JetBrains extensions, and process names - 48 AI tools detected by name
NetworkConnection monitoring identifies 115 AI service endpoints across 69 providers, plus 7 local inference servers, by destination
BehavioralBehavioral heuristics recognize how AI tools act - catching unknown and custom tools no signature list has heard of
TelemetryDeep session telemetry for Claude Code - full conversation replay, token tracking, MCP visibility
DependencyDependency monitoring across 9 package formats, with known vulnerabilities flagged automatically
What You See

The Monitoring Surface

AI session list grouped by tool, device, and day, each row showing risk score, session count, secret findings, and cost
AI sessions grouped by tool, device, and day - each group leads with risk score, session count, secret findings, and cost.
Per-device AI tool inventory listing each detected tool with version, first seen, and last seen dates
Per-device AI tool inventory - every tool found by name or by network destination, with version and first and last seen.
Cost and usage analytics with total cost, cache hit ratio, cost over time chart, and per-developer breakdown
Cost and usage - spend attribution by developer, repo, model, and team, with cache hit ratio and a 30-day trend.
AI egress console listing destinations with provider, sanctioned or shadow classification, connection volume, and sanction and not-allowed labels
AI egress - every destination classified sanctioned or shadow, ranked by connection volume, with sanction and not-allowed labels.
How It Works

From Endpoint to Dashboard

  1. Step 01

    Collect locally

    The agent observes AI tools, sessions, connections, and dependencies on the endpoint itself.

  2. Step 02

    Stream securely

    Telemetry streams over an encrypted, mutually authenticated channel, buffered locally and replayed on reconnect - an offline laptop loses nothing.

  3. Step 03

    Process and attribute

    The ingestion service maps activity to user, team, device, repo, and model, then prices it.

  4. Step 04

    Surface in seconds

    Sessions appear on the Live Floor with sub-second latency; inventory refreshes on its own cadence.

Compliance

Controls This Pillar Satisfies

NIST SI-4
System monitoring - continuous behavioral and network monitoring
ISO A.8.16
Monitoring activities across every endpoint
SOC 2 CC7.2
System monitoring with real-time alerting
Related
ProtectEnforce policy on what you seeRespondContain what goes wrongAssetsInventory beneath it all

See Kraitos AIDR in Action

Enroll an endpoint and see which AI tools it runs. Stop guessing what your AI-augmented organization is doing.

Book a DemoStart Free Trial

[email protected]kraitos.io