Runewrd Labs
ConsoleGet early access
MenuClose

Coverage by agent type

Wherever your agents run, know what is covered.

Coverage differs by agent type and platform. This page lists what Runeward Labs covers today and what is still planned.

Coding and personal agents

Terminal and IDE agents with access to source code, credentials and the developer’s shell.

  • Claude Code
  • Codex
  • Cursor
  • GitHub Copilot CLI
  • Gemini CLI
  • Windsurf
  • Cline
  • Guard: inventory, sensor findings and harness hooks on the endpoint
  • Guard: local scan of harness settings and rules
  • LiveRune Box: run the agent CLI in a governed environment

Browser and desktop AI

Chat assistants in the browser where screenshots and pasted data leave the device.

  • ChatGPT in Chrome
  • Claude in Chrome
  • Guard: screenshot attach, paste and upload correlation (macOS)
  • Guard: Gemini, Copilot and Perplexity coverage; multipart uploads
  • Rune Box: governed browser actions (off by default)

MCP servers and tools

The tools your agents call, and the supply chain behind them.

Examples: Local stdio servers and remote HTTP servers

  • Guard: MCP inventory with risky-configuration findings
  • Guard: tool pinning and definition-change alerts
  • LiveRune Box: governed tools exposed over MCP

Framework and automation agents

Agents built on frameworks and run in CI, servers or Kubernetes.

  • LangChain
  • CrewAI
  • LlamaIndex
  • OpenAI Agents
  • Strands
  • Vercel AI SDK
  • LiveRune Box: SDK adapters, policy, approvals, budgets and signed audit
  • LiveRune Box: Kubernetes CRDs with strict L3 egress

Cloud and SaaS agents

Agents running inside third-party platforms.

Examples: Hosted agent platforms and SaaS copilots

  • PreviewConnectors for cloud and SaaS agent platforms

Coverage

Coverage matrix: what Gurd misses today.

What Guard covers in each area today, and what it doesn’t yet.

AreaCoveredNot covered yet
Harness hooksRetained Cursor CLI, Copilot CLI, Gemini CLI and Cline results cover specific client paths against synthetic backends. VS Code Copilot, Kimi Code and Qwen Code have source and fixture tests.No retained live Claude Code result. Editor and new native-client qualification remains separate; vendor failures can let actions proceed. Continue, Aider and Zed have no blocking hook.
Shell analysisVariables, globs, scripts, eval and substitutions followed up to four levels.Strings built at run time, paths built inside programs, other languages.
MCPConfiguration inventory, tool pins and poisoning checks; adopted gateway calls. Real Chrome DevTools MCP and headless Chrome have a retained macOS protocol-client result for routed tool refusal and textual secret redaction.Unwrapped MCP, direct CDP, browser network effects, resources and prompts. Chrome evidence does not qualify every agent, model, extension, profile or OS.
Local and hosted modelsCatalog API destinations and positively identified local listeners, including MLX-LM and SGLang. DeepSeek, Kimi, Qwen and arbitrary model aliases exercise fixtures independently of model-family names.Destination recognition is not inference or interception. Generic/custom ports need listener evidence; LAN, container proxies and Python wrappers can remain unknown. Model-list APIs do not all prove memory residency; new runtimes have no live qualification.
Agent postureCatalog settings, rules, memory and skills, including rules files in project subdirectories within bounded walks; selected extension identities; package heuristics and look-alike checks for npm, PyPI, crates.io, NuGet and RubyGems. The sensor reports agent CLIs started with a bypass flag or a moved configuration directory, and on macOS guard scan lists the privacy grants AI tools already hold.An installation is not execution. Editor state, managed VS Code AI policies, MDM, unlisted registry keys and server settings remain incomplete. Flags set in a configuration file aren’t seen, and a moved directory is seen only on Linux and through eslogger. Registry-existence checks need a name snapshot or opt-in lookups. No maliciousness verdict from a static match.
Keychain and clipboardKeychain requests on macOS 14+; Linux clipboard commands and history files.Which item or whether access was granted; in-process clipboard APIs.
Egress correlationA credential read or capture followed by a recognized AI destination, within the available session evidence, and a credential read followed by contact with that credential’s own service. Windows reports bytes sent.Short macOS polling connections, IP-only wildcard destinations, proxies and what was sent: the order of two steps never proves a credential was sent. Sensor observations do not prevent traffic.
Session rulesLethal trifecta, post-ingestion anomaly and retry after block; newly completed hook session findings are logged and uploaded.Hook and sensor evidence is not joined for session rules. Only delivered events participate, and missing history is not zero activity.
PlatformsmacOS, Linux and Windows. macOS: an eslogger bridge that observes and reports. Linux: process, file and eBPF network collection. Windows: ETW.On macOS the sensor observes and reports. APT and DNF repositories are not published. Windows sees opens after the fact.

Your agents already have access. Ward off the risks.

Join Guard early access for your team, or run the free local scan today. Agents in automation too? Add the open-source Rune Box.

Get Guard early accessRun the free scan