About Bay
Bay is an AI agent security platform that gives enterprises visibility into every agent across devices, browsers and cloud workloads, and control over what those agents do in real time. Bay describes AI endpoint security as protection for the AI agents, coding assistants and MCP servers running on employee devices. Bay was founded by three engineers who spent their careers in endpoint and API security. Bay is a Series A stage company.[2][3]
Teams run agents like Claude Code, Codex, Gemini CLI and GitHub Copilot in clusters, cloud workspaces and hosted sessions.[5]
Bay finds and maps agents first. On the first scan, Bay maps every agent, MCP server, extension, model and skill on devices, including ones nobody approved. Bay finds every agent, extension, CLI tool, MCP server, skill and model on employee devices. Bay builds a contextual entity graph of how everything connects: the user behind each agent, the MCP servers and SaaS apps it touches, and the access it holds. Bay scans every agent, package, extension, MCP server and skill for malicious indicators before approval. In the browser, Bay brings shadow AI into view, covering chatbots, extensions and embedded SaaS agents. In cloud environments, Bay discovers agents across virtual machines, Kubernetes, Coder workspaces and hosted sessions.[1][3][5][6][7]
Lighthouse, Bay's embedded agentic system, drafts policy from an organization's own agent activity. Users answer 7 questions about risk appetite, and Lighthouse recommends a setting for each question and builds the policy. Policies can be scoped by IdP group, device or runtime, and can set which MCP servers can read or write. Before enforcement, Bay replays 30 days of agent history to show what a policy would do before any user is affected. Bay also lets teams run any policy in simulation mode to see what it would allow, ask or block. At runtime, Bay enforces guardrails inline with the agentic action and returns allow, ask, steer or block in milliseconds. Bay can also prevent prompt injection attempts at runtime.[6]
Bay keeps records of agent activity. Bay keeps full transcripts of prompts, actions and MCP calls, traceable to the person behind each session. A metadata-only mode in Bay keeps prompts on the device when they must not leave it. Bay ties every prompt and agent action to a real identity, corporate or personal. Bay logs every policy change and agent action with who approved it and whether a person or an agent took it. Every decision in Bay is logged against the policy behind it, ready for auditors. Bay connects to an identity provider, so every policy applies to the right people and groups.[5][6][7][8]
Bay also checks configuration. Bay checks how every agent and AI tool is set up, across devices and cloud workloads, so risky settings can be fixed before an agent puts them to use. Bay spots bypass-permissions mode, sandboxes switched off and unrestricted tool access, rates how serious each one is and shows how to fix it. Bay finds the credentials, tokens and secrets that agents and MCP servers can read.[9]
Bay deploys with one script through an existing MDM and does not require a proxy to route traffic through. Bay deploys through an existing MDM or EDR using Wave, an ephemeral binary, so there is no persistent agent to maintain. Bay tells corporate AI accounts from personal ones, including in personal Chrome profiles. Bay's enterprise customers include Micron Technology, Peloton and ClickUp.[1][2][3][6][7][8]
Bay on the record