Integrations
Every AI surface. Governed from one place.
MCP clients, AI API proxies, browser-based AI services, vibe-coding platforms, local model runtimes, SaaS admin APIs, identity providers, device management, SIEM destinations. No agent code changes. Here's the full map.
The numbers.
Agents point at the proxy. Policy enforced from day one. Your SIEM gets better data. Your compliance team gets an audit artifact. Counts below describe what Behavry can connect to; protocol compatibility is not the same as a tested workflow integration, so confirm the status of a specific product for your deployment.
12 MCP clients/6 AI API proxies/12 browser services/7 vibe-coding platforms/12 local AI runtimes/56 AI platforms discoverable/3 UEM connectors/6 SIEM destinations
MCP clients.
Agents point their MCP config at the Behavry proxy. Every tool call is governed before execution: identity, DLP, policy, audit. No agent code changes. These twelve ship a guided enrollment flow with a ready-to-paste config; every other MCP client works through the same proxy.
| Client | Transport |
|---|---|
| Claude Code | Streamable HTTP |
| Claude Desktop | stdio bridge |
| Cursor | Streamable HTTP |
| VS Code (GitHub Copilot) | SSE |
| Windsurf (Codeium) | Streamable HTTP |
| Warp | Streamable HTTP |
| Zed | Streamable HTTP |
| Antigravity (Google) | Streamable HTTP |
| Kiro (Amazon) | Streamable HTTP |
| Codex CLI (OpenAI) | Streamable HTTP |
| OpenAI (ChatGPT / Codex) | Streamable HTTP |
| Open Interpreter | Streamable HTTP |
Those twelve ship a one-click config template. They are not the limit: any MCP client speaking Streamable HTTP, SSE or stdio is governed by the same proxy without one — JetBrains IDEs, Cline and Continue among them. The proxy is protocol-agnostic. Aggregating gateways are governed as gateways, not as one opaque server: the downstream system is recovered from the namespaced tool name, so halo_create_ticket and ninjaone_run_script reach policy and the Decision Trace as Halo and NinjaOne. Tool coverage is bounded by the protocol, not by a connector catalogue.
AI API proxies.
Transparent reverse proxies for major AI model APIs. Identity, DLP, policy, and audit applied to every API call. Token extraction for cost attribution across all 6.
| Provider | Models |
|---|---|
| OpenAI | GPT-4o, o1, o3 |
| Anthropic | Claude 4, Sonnet, Haiku |
| Google Gemini | Gemini 2.5 |
| Ollama | Local models |
| NemoClaw | NVIDIA NIM |
| OpenShell | Open-source models |
Cost attribution with 14 seeded model prices + tenant-configurable overrides. Aggregation API with CSV export.
Browser extension.
DLP scanning on browser-based AI interactions. 33 patterns in real time. Shadow AI detection for unenrolled services.
ChatGPT/Claude/Gemini/Perplexity/DeepSeek/Copilot/Poe/HuggingChat/You.com/Phind/Mistral Le Chat/GitHub Copilot Chat
Vibe-coding platforms.
DOM fingerprinting + platform API connectors discover and govern apps built by non-developers. 7-signal risk scoring. OPA policy enforcement. Full story →
| Platform | Discovery method |
|---|---|
| Replit | DOM + GraphQL API |
| Lovable | DOM + Netlify deploy-domain match |
| Bolt | DOM + Netlify/StackBlitz deploy-domain match |
| v0 / Vercel | DOM + REST API |
| Cursor | IDE domain matching |
| Windsurf | IDE domain matching |
| Copilot Workspace | IDE domain matching |
AI surface discovery.
Four-state model: Licensed → Enabled → Active → Governed. Cross-references IdP apps, SaaS admin APIs, and browser fingerprints.
| Okta | Read-only app list |
| Azure AD / Entra ID | Read-only app list |
| Google Workspace | Read-only app list |
| Microsoft 365 | Copilot SKU + usage |
| GitHub | Copilot billing + seats |
| Slack | AI feature flags |
| Google Workspace | Gemini per-OU |
| Salesforce | Einstein enablement |
| Atlassian | AI feature status |
| ServiceNow | Now Assist |
| Zendesk | AI feature status |
56 AI-capable SaaS platforms in the fingerprint DB. Browser extension adds 10 passive DOM fingerprint rules for admin page detection. Credentials encrypted via AES-256-GCM.
The models running on the laptop.
Shadow AI is not only SaaS. A local model needs no license, no admin console, and no IdP app, so it appears in none of the places discovery usually looks. Behavry fingerprints twelve local and self-hosted runtimes and routes each to a governance path.
| Runtime | Risk | Governance path |
|---|---|---|
| Ollama | High | MCP proxy agent enrollment |
| LM Studio | High | MCP proxy agent enrollment |
| vLLM | High | MCP proxy agent enrollment |
| LiteLLM | High | MCP proxy agent enrollment |
| LocalAI | High | MCP proxy agent enrollment |
| HuggingFace TGI | High | MCP proxy agent enrollment |
| Local MCP Server | High | Behavry MCP proxy |
| Open WebUI | Medium | Extension enrollment |
| LibreChat | Medium | Extension enrollment |
| Gradio | Medium | Extension enrollment |
| ComfyUI | Medium | Extension enrollment |
| Stable Diffusion WebUI | Medium | Extension enrollment |
The Warden desktop proxy carries a compiled provider registry, extensible per tenant to 100 providers and 50 hosts each. New providers reach the fleet on the next policy poll rather than waiting on a signed, notarized agent release.
Coverage needs a denominator.
“We govern 400 endpoints” means nothing without knowing how many exist. Behavry pulls device inventory from your UEM so coverage is a fraction, not a count, and publishes a risk posture back into the UEM’s own grouping primitive so your existing Conditional Access policy can act on it.
| Provider | Direction |
|---|---|
| Microsoft Intune | Inventory in · posture out |
| Google Endpoint Management | Inventory in · posture out |
| Omnissa Workspace ONE | Inventory in · posture out |
UEM is never a time-sensitive enforcement path. Intune device check-in is roughly eight hours; the Warden and extension policy channel is seconds, and anything urgent goes there. Behavry publishes posture and your policy engine enforces — we issue no destructive device commands and never request the scope to, so a false positive cannot become an unappealable Behavry 403.
SIEM and security operations.
Structured, identity-attributed audit events in your existing SIEM. Better data in the glass you already have.
| Destination | Transport |
|---|---|
| Splunk | HEC (HTTP Event Collector) |
| Microsoft Sentinel | Data Collector API |
| Google Chronicle | Ingestion API |
| IBM QRadar | LEEF 2.0 |
| Generic syslog | RFC 5424 over TCP/TLS |
Plus webhook delivery to Slack, PagerDuty, or any custom endpoint. Configurable severity filtering. Signed payloads with retry and dead-letter queue.
Every event Behavry exports is Ed25519-signed and SHA-256 hash-chained, with a Merkle root over the bundle. Your SIEM holds a copy your auditor can verify offline against a trust anchor frozen at enrollment — with no Behavry service in the loop. See the open-verifier promise →
Data protection.
Four-stage pipeline: classification, redaction with pseudonymization, BYOK envelope encryption (AES-256-GCM + AWS KMS), and retention purge with decryption audit trail.
AWS keys/GitHub tokens/Private keys/SSNs/Credit cards/OAuth tokens/API keys/Email addresses/Phone numbers/IP addresses
33 patterns total. Luhn validation, SSN structure checks, cross-session fragment reassembly detection. Critical-severity patterns auto-block before OPA evaluation. DB-managed with hot-reload. Add custom patterns without restart.
The patterns nobody can write.
A regex finds an AWS key because an AWS key has a shape. A person’s name in a sentence does not. The Privacy Filter is an inference service for the sensitive data that has no signature — and it is deliberately kept out of the path that denies a tool call.
Default mode is flag: a Privacy Filter hit annotates the Decision Trace but never denies on its own. A deny is always traceable to a deterministic match.
Tenants who opt into block nominate which labels may block — SECRET and GOVERNMENT_ID by default. Everything else still only flags.
Spans below the tenant’s minimum confidence are discarded before they reach policy. Default 0.85, configurable per tenant.
Two-second timeout, circuit opens after five consecutive failures, and classification returns nothing rather than stalling a decision. A PF_UNAVAILABLE event fires the moment the circuit opens — regex DLP continues throughout.
| Surface | Where it runs | Status |
|---|---|---|
| ECS inference service | Your VPC, behind the data plane | Shipped |
| Browser WebGPU | On the endpoint, in the extension | Reserved in the source taxonomy; not yet emitting |
| ONNX runtime | On the endpoint, local inference | Reserved in the source taxonomy; not yet emitting |
Every Privacy Filter finding is labelled with its source, so a reviewer can tell a probabilistic hit from a checksum-validated one without reading the code. That distinction is what lets the record stay defensible: an auditor asking why a call was denied gets a deterministic pattern, not a confidence score. See the reasoning on the architectural trade-offs page.
Answer “what would this have blocked?” before you ship it.
A policy change in a governance system is a production change. Every scenario below runs against real OPA evaluation and returns the diff, the affected objects, and the coverage gap — without applying anything.
| Scenario | Answers |
|---|---|
| Event replay | Replays an observed audit event against current or proposed policy |
| Policy | Real OPA evaluation against synthetic inputs |
| Compliance | Coverage delta before enabling a framework |
| Agent | What an agent could do given a role and permission set |
| Workflow | Multi-agent trace simulation across a chain |
| Provisioning | Pre-enrollment dry run |
| Risk reduction | Impact of applying recommended controls |
| Library pack | Preview of enabling a policy, framework, or template pack |
| Recommendation | Impact of accepting an insight |
| Settings | Config-change impact on enforcement coverage |
Every simulation is itself audited. Asking what a policy would have done is a governance action, and it leaves a record.
Frameworks and deployment models.
Thirteen frameworks. 170 controls mapped. Four ways to run the stack. All models share a single data plane image with identical governance capabilities regardless of deployment.
| Framework | Controls |
|---|---|
| SOC 2 | 8 — CC6.1 · CC6.2 · CC6.3 · CC6.6 · CC7.2 · CC7.3 · CC8.1 · CC9.2 |
| ISO/IEC 27001:2022 | 8 — A.5.15 · A.5.28 · A.8.2 · A.8.10 · A.8.12 · A.8.15 · A.8.16 · A.8.24 |
| NIST AI RMF 1.0 | 8 — GV-1.2 · GV-6.2 · MP-2.3 · MP-4.1 · MG-2.1 · MG-2.2 · MG-4.2 · GO-1.7 |
| EU AI Act | 8 — Art. 9 · 14 · 26(1) · 26(2) · 26(5) · 26(6) · 29(6) · 72 |
| HIPAA Security Rule | 7 — §164.312(a)(1) · (b) · (c)(1) · (e)(1) · §164.308(a)(1)(ii)(D) · (a)(6) · §164.530(j) |
| PCI DSS v4.0 | 8 — Req 6.3 · 7 · 8.2 · 8.3 · 10.2 · 10.5 · 11.5 · 12.3 |
| HITRUST AI | 18 — AI.GOV-1–4 · AI.DP-1–4 · AI.MS-1–4 · AI.TA-1–3 · AI.TP-1–3 |
| CIS AI/ML | 14 — CIS-AI-1.1 through CIS-AI-5.2 |
| OWASP ASI | 10 — ASI01 through ASI10 |
| AIUC-1 | 51 — AI Use Case Framework v1, series A–F |
| Financial services | 13 — OCC SR 11-7 §IV.A–C · NYDFS §500.6 · §500.7 · SEC §275.206(4)-7 · §275.204-2 · Reg S-P §248.30 |
| Insurance | 7 — NAIC Model Bulletin §III.A–C · Colorado §10-3-1104.9(4)–(5) · IDFPR Bulletin 2024-01 |
| Privacy | 10 — GDPR Art. 5(1)(c) · 15 · 17 · 32 · CCPA §1798.100(b) · §1798.105 · LGPD Art. 7(I) · 33 · PIPEDA 4.7 · 4.9 |
What “mapped” means. Our shipped controls satisfy the named clauses today. It does not mean an independent auditor has certified them. SOC 2 Type II is on the roadmap; ISO 27001 certification has not been pursued. Current status on the Trust Center. Full framework-to-control mapping with PDF export in the dashboard.
Behavry manages everything. Fastest start.
Control plane SaaS. Data plane in your VPC.
Full stack in your cloud. Helm + Terraform.
Air-gapped. No external dependencies.
- ARCHITECTURE
One vantage point in the path of the action, across supported agent surfaces.
- MCP AUTHORIZATION
Inline enforcement at the tool call, evaluated before the call executes.
- ECOSYSTEM
How inline authorization fits the rest of the identity and security stack.
Zero agent code changes. Deploys in a day.
BOOK A DEMO →MSP or MSSP? Discuss a pilot →