Agent Security

Find risky agent behavior.

Beams records AI agent conversations and tool-call messages. Teleport classifiers flag risky behavior and link findings to the recorded evidence.

Try for Free

Beams secrets-exposure finding with Medium risk, linked to evidence item 13: a deploy script printing an example AWS access key ID. — A finding, backed by recorded evidence. Explore the evidence

Capture

The Teleport LLM Gateway records LLM requests, responses, and tool-call messages.

Classify

Flag credential exposure, privilege changes, and risky actions when the session is summarized.

Investigate

Open a finding and follow the recorded evidence to the exact tool call.

Classifiers review sessions after summarization. Findings identify activity to investigate; they do not block execution.

How to read a session

MCP tool-call review is planned.

Beams links a secrets-exposure finding to the deploy.sh tool call, its command, and the classifier evidence. — Follow the evidence.

Trace a classifier finding to the tool call, command, and recorded activity.

Explore this session

Start with a security question.

Did the agent access or expose secrets?

Did the agent gain more access?

Did the agent delete or overwrite data?

Where did the agent send data?

Session summaries and risk scoring are included with Enterprise. See pricing and packaging.

Can I define my own classifiers?

Duplicate a built-in classifier and describe the behavior you want to review. Choose session kinds, resource filters, and match actions: flag for review, raise risk, or emit an audit event.