AariaSec · What We Detect

133 AI agents in the AariaSec registry

Public list of agents the platform recognises by name. Anything else still gets caught on the traffic side the moment it makes an LLM API call — we just don't have a friendly label for it yet. Spotted a missing app? Suggest it — we review every submission.

• AutoGen agent_framework cloud egress
  Capabilities: networkreads fileswrites filesruns shell
  via multiple · api.openai.com, api.anthropic.com
  What it does: Multi-agent system with code execution and autonomous loops. Agents can write and execute Python code, run indefinitely, and spawn sub-conversations without human oversight

  Operator note: Always set max_consecutive_auto_reply limits. Use Docker execution for code generation. Implement conversation length caps. Never deploy with internet-accessible code execution.
• AutoGPT agent_framework cloud egress
  Capabilities: networkreads fileswrites filesruns shell
  via openai · api.openai.com
  What it does: Autonomous agent that can write and execute code, read and write files, browse the web, and call APIs without per-step confirmation

  Operator note: Run only inside a container or VM. Never give it your real shell or unlimited API keys. Cap iterations explicitly.
• BabyAGI agent_framework cloud egress
  Capabilities: networkreads filesruns shell
  via openai · api.openai.com
  What it does: Autonomous task-creation agent — generates and executes its own task list indefinitely, creating new sub-tasks without human approval

  Operator note: Always set iteration limits. Run in isolated environment. Monitor task generation for scope creep.
• Composio agent_framework cloud egress
  Capabilities: networkreads filesgit
  via multiple · api.openai.com, api.anthropic.com
  What it does: Tool integration platform for AI agents — provides 150+ tool integrations (GitHub, Slack, databases) that agents can call autonomously

  Operator note: Audit connected integrations. Use least-privilege OAuth scopes. Monitor tool invocations.
• CrewAI agent_framework cloud egress
  Capabilities: networkreads filesruns shell
  via multiple · api.openai.com, api.anthropic.com
  What it does: Multi-agent orchestration with autonomous task delegation. Agents delegate sub-tasks to each other, amplifying the blast radius of any single compromised agent

  Operator note: Define strict role boundaries per agent. Limit tool access per crew member. Log all inter-agent delegations. Test with adversarial scenarios before deployment.
• Dify agent_framework mixed egress
  Capabilities: networkreads filesruns shell
  via multiple · api.openai.com, api.anthropic.com, api.dify.ai
  What it does: Self-hosted LLM app builder — can run multi-step workflows, call external APIs, execute code, and ingest data sources. Cloud APIs receive workflow inputs which may include sensitive enterprise data.

  Operator note: Use local model providers for sensitive workflows. Restrict tool access per workflow. Enable Dify's audit log. Keep the self-hosted instance behind a VPN.
• Flowise agent_framework cloud egress
  Capabilities: networkreads filesruns shell
  via multiple · api.openai.com, api.anthropic.com
  What it does: Visual drag-and-drop agent builder — chains LLMs, tools, and vector stores. Flows often run autonomously and can call external APIs, execute code, and read files.

  Operator note: Add authentication (FLOWISE_USERNAME/PASSWORD env vars). Restrict to localhost. Audit each flow for tool scope. Don't expose publicly without an API key.
• Haystack agent_framework cloud egress
  Capabilities: networkreads files
  via multiple · api.openai.com, api.anthropic.com
  What it does: NLP/RAG pipeline framework — builds pipelines that process and query documents with LLMs

  Operator note: Validate pipeline inputs. Sanitize documents for injection. Monitor pipeline execution.
• LangChain agent_framework cloud egress
  Capabilities: networkreads filesruns shell
  via multiple · api.openai.com, api.anthropic.com
  What it does: Agent framework with tool execution and chain-of-action patterns. Agents can autonomously decide which tools to call, including shell, file, and web tools

  Operator note: Use LangChain's tool permission system. Avoid shell/file tools in production agents. Implement human-in-the-loop for high-risk actions. Monitor agent traces via LangSmith.
• Langflow agent_framework cloud egress
  Capabilities: networkreads filesruns shell
  via multiple · api.openai.com, api.anthropic.com
  What it does: Visual LangChain builder — composes LLM chains, agents, and tools via a web UI. Flows can execute shell commands, query databases, and call external APIs autonomously.

  Operator note: Add authentication in Langflow settings. Run behind a firewall. Review each flow's tool access. Use local LLMs for sensitive pipelines.
• LangGraph agent_framework cloud egress
  Capabilities: networkreads filesruns shell
  via multiple · api.openai.com, api.anthropic.com
  What it does: Stateful agent orchestration with cyclical workflows — agents can loop, branch, and make autonomous decisions with persistent memory

  Operator note: Set max iteration limits. Implement checkpoints and human-in-the-loop breakpoints. Monitor state transitions.
• LlamaIndex agent_framework cloud egress
  Capabilities: networkreads files
  via multiple · api.openai.com, api.anthropic.com
  What it does: RAG framework with data ingestion and query pipelines. Ingests documents that may contain prompt injection payloads embedded in data sources

  Operator note: Sanitize ingested documents for injection patterns. Use metadata filtering to isolate data sources. Validate query results before acting on them.
• MetaGPT agent_framework cloud egress
  Capabilities: networkreads fileswrites filesruns shell
  via openai · api.openai.com
  What it does: Multi-agent framework that simulates a software team — agents can write and execute code and modify files across a project

  Operator note: Keep the workspace dir isolated. Review generated code before running the test/deploy steps.
• n8n (AI Workflow Automation) agent_framework cloud egress
  Capabilities: networkreads filesruns shell
  via multiple · api.openai.com, api.anthropic.com
  What it does: Workflow automation with AI nodes — can call LLMs, access files, query databases, send emails, post to Slack, and interact with any HTTP API, all unattended.

  Operator note: Enable n8n authentication. Restrict credentials to least-privilege. Review AI Agent nodes for unbounded tool access. Don't expose on 0.0.0.0 without auth.
• OpenDevin / OpenHands agent_framework cloud egress
  Capabilities: networkreads fileswrites filesruns shell
  via multiple · api.anthropic.com, api.openai.com
  What it does: Open-source autonomous coding agent — full shell access, file write, and network access inside its sandbox

  Operator note: Uses Docker sandboxing by default — keep that on. Don't mount your real home directory.
• Phidata agent_framework cloud egress
  Capabilities: networkreads filesruns shell
  via multiple · api.openai.com, api.anthropic.com
  What it does: AI agent framework with built-in tools for web search, database queries, and file operations

  Operator note: Restrict tool access. Monitor database queries. Validate web search results.
• Pydantic AI agent_framework cloud egress
  Capabilities: network
  via multiple · api.openai.com, api.anthropic.com, generativelanguage.googleapis.com
  What it does: Type-safe agent framework from the Pydantic team — structured tool use and dependency injection for LLM agents. Agents can call arbitrary tools with validated inputs.

  Operator note: Define strict tool allowlists. Validate tool outputs before acting on them. Monitor model usage costs.
• Semantic Kernel (Microsoft) agent_framework cloud egress
  Capabilities: networkreads filesruns shell
  via multiple · api.openai.com
  What it does: Microsoft's AI orchestration SDK — integrates LLMs with native functions, plugins, and planners that can execute code autonomously

  Operator note: Restrict plugin permissions. Validate planner outputs. Use function-level access controls.
• smolagents (Hugging Face) agent_framework cloud egress
  Capabilities: networkreads filesruns shell
  via multiple · api.openai.com, api.anthropic.com
  What it does: Hugging Face agent framework — lightweight but allows code execution and tool use with minimal guardrails

  Operator note: Restrict available tools. Use sandboxed execution. Monitor agent actions.
• SuperAGI agent_framework cloud egress
  Capabilities: networkreads filesruns shell
  via multiple · api.openai.com
  What it does: Autonomous agent platform with tool execution, resource management, and self-spawning capabilities — agents can create sub-agents

  Operator note: Set strict resource limits. Disable self-spawning in production. Monitor all tool invocations.
• SWE-agent agent_framework cloud egress
  Capabilities: networkreads fileswrites filesruns shell
  via multiple · api.anthropic.com, api.openai.com
  What it does: Agentic coding agent designed to reproduce and fix GitHub issues — full repo read/write + command execution

  Operator note: Only run against test repos or fresh clones you're willing to lose. Uses Docker by default — keep it on.
• LiteLLM Proxy ai_gateway cloud egress
  Capabilities: network
  via multiple · localhost:4000
  What it does: LLM API gateway — routes requests to 100+ LLM providers, manages API keys, can log all prompts/responses if configured

  Operator note: Review logging config. Secure API key storage. Monitor request patterns for exfiltration.
• OpenRouter SDK ai_gateway cloud egress
  Capabilities: network
  via multiple · openrouter.ai
  What it does: Multi-model API gateway — routes to OpenAI, Anthropic, Google, and others through a single API

  Operator note: Monitor model selection. Review cost settings. Use spending limits.
• ChatGPT Agent (Operator) autonomous-agent-framework cloud egress
  Capabilities: reads fileswrites filesruns shellnetwork
  via openai · operator.chatgpt.com, api.openai.com, chatgpt.com
  What it does: OpenAI's computer-using agent. Runs inside the ChatGPT desktop app; takes browser, file, and shell actions on behalf of the user. Distinguished from plain ChatGPT by traffic to operator.chatgpt.com.

  Operator note: Enable AariaSec proxy to flag agent-mode sessions by endpoint. Limit agent's filesystem scope via OS sandboxing. Review the action log before approving each step.
• Devin (Cognition AI) autonomous-agent-framework cloud egress
  Capabilities: reads fileswrites filesruns shellnetworkgit
  via anthropic · app.devin.ai, api.cognition.ai
  What it does: Autonomous software engineer — operates a full sandbox with shell, browser, and file access. Long-horizon agentic execution with minimal human approval. Primarily cloud-hosted; desktop wrapper if installed gives the same egress posture.

  Operator note: Treat Devin sessions as a separate org-level identity. Apply egress allow-list to sensitive repos. Review every PR Devin authors with human sign-off — do not auto-merge.
• Hermes Agent (NousResearch) autonomous-agent-framework cloud+local egress
  Capabilities: networkreads filesfilesystem_writespawns processespersistent_memory
  via multi · api.openai.com, api.anthropic.com, localhost:11434
  What it does: Self-improving autonomous agent with cross-session skill creation, persistent memory, multi-platform C2 channels (Telegram/Discord/WhatsApp/Signal/email), concurrent subagent spawning. Behavioral fingerprint will drift across sessions due to learned skills.

  Operator note: Apply capability token enforcement (C82). Monitor for messaging-platform API egress (AWR-257). Behavioral fingerprint drift triggers relearning window — treat as new agent identity after skill acquisition events.
• Arc Browser (Max AI) browser cloud egress
  Capabilities: networkbrowser
  via openai · api.openai.com, api.anthropic.com
  What it does: Built-in AI summarisation and tab browsing — reads page content and sends it to third-party LLMs

  Operator note: Disable Arc Max features you don't use. Opt out in Settings → Max.
• Brave Browser (Leo AI) browser cloud egress
  Capabilities: networkbrowser
  via multiple · api.anthropic.com, ai-chat.bsg.brave.com
  What it does: Leo AI assistant reads page content, answers questions, and can summarise — content leaves the browser

  Operator note: Leo can be disabled per-site. Default to 'no assistant' mode on sensitive tabs.
• ChatGPT Atlas Browser browser cloud egress
  Capabilities: reads filesnetwork
  via openai · chatgpt.com, api.openai.com, operator.chatgpt.com
  What it does: OpenAI's browser, launched October 2025. Agent Mode performs multi-step autonomous browsing — fills forms, navigates SaaS apps, submits actions on the user's behalf. Treat as a delegated user identity, not just a browser.

  Operator note: Disable Agent Mode for sensitive SaaS apps. Enforce SSO/MFA on every site Atlas can reach. Audit Atlas's session log per user.
• Chrome (Gemini AI) browser cloud egress
  Capabilities: networkbrowser
  via google · generativelanguage.googleapis.com, gemini.google.com
  What it does: Chrome 121+ ships Gemini as a native browser assistant (Ask Gemini in address bar, tab summarisation, Help me write). Page content is sent to Google's Gemini API without explicit per-prompt consent.

  Operator note: Disable 'Help me write' and tab summarisation in Chrome Settings → Gemini. Use managed browser policies (GenAiDefaultSettings) to disable fleet-wide.
• Dia Browser (Atlassian) browser cloud egress
  Capabilities: reads filesnetwork
  via anthropic · diabrowser.com, thebrowser.company, api.anthropic.com
  What it does: The Browser Company's Dia, acquired by Atlassian September 2025. Positioned as 'the browser for knowledge workers' — integrates with Jira/Confluence + has agentic browsing. Likely default install in Atlassian-shop orgs.

  Operator note: Treat as both a browser AND an Atlassian access channel. Enforce SSO on Atlassian + content-scope policies on Dia's agent mode.
• Microsoft Edge (Copilot AI) browser cloud egress
  Capabilities: networkbrowser
  via openai · www.bing.com, copilot.microsoft.com, sydney.bing.com
  What it does: Edge ships Copilot (formerly Bing AI) as a persistent sidebar panel. It can read the current page, summarise content, compose email, and answer questions — page text sent to Microsoft's Azure OpenAI endpoints.

  Operator note: Disable Copilot sidebar in Edge Settings → Sidebar → Copilot. Enterprise: use EdgeEnableCopilot group policy (set to Disabled). Restrict bing.com/copilot.microsoft.com at the proxy level.
• Opera (Aria) browser cloud egress
  Capabilities: networkbrowser
  via openai · composer.opera-api.com, api.openai.com
  What it does: Aria is always-on in the sidebar — can read the current page, generate text, and execute browser actions

  Operator note: Sign out of Aria on shared machines. Disable 'page-aware chat' per site.
• Perplexity Comet Browser browser cloud egress
  Capabilities: networkbrowserreads files
  via perplexity · www.perplexity.ai, api.perplexity.ai
  What it does: AI-native browser — can autonomously click, fill forms, and navigate pages on the user's behalf. Significant agent permission scope

  Operator note: Review Comet's default 'act on the page' permission. Disable agent mode on banking and mail sites.
• SigmaOS Browser browser cloud egress
  Capabilities: reads filesnetwork
  via multiple · sigmaos.com, api.openai.com, api.anthropic.com
  What it does: Free agentic browser across all major OSes. Low-friction install — typically arrives via personal adoption before IT notices. Lower install base than Atlas/Dia but growing.

  Operator note: Block at MDM if not approved. Enforce egress allow-list on managed networks.
• AIChat cli mixed egress
  Capabilities: network
  via multiple · api.openai.com, api.anthropic.com
  What it does: Terminal chat client for multiple LLM providers — sends prompts to configured API

  Operator note: Avoid piping sensitive data. Review which provider is configured.
• Aider cli cloud egress
  Capabilities: reads fileswrites filesruns shellnetworkgit
  via multiple · api.openai.com, api.anthropic.com
  What it does: Autonomous code editing with git commit capability. Can modify files and commit directly to your repository without review gates

  Operator note: Use --no-auto-commits to require manual review. Run in a feature branch, never directly on main. Review diffs before accepting changes.
• avante.nvim cli mixed egress
  Capabilities: reads filesnetwork
  via multiple · api.openai.com, api.anthropic.com, generativelanguage.googleapis.com
  What it does: Cursor-style AI coding plugin for Neovim — sends buffer/code context to whichever OpenAI-compatible endpoint is configured, including self-hosted or third-party proxies

  Operator note: Audit the configured provider in the plugin's Lua config under ~/.config/nvim. Prefer a monitored endpoint for sensitive repos.
• Claude Code cli cloud egress
  Capabilities: reads fileswrites filesruns shellnetworkgit
  via anthropic · api.anthropic.com
  What it does: Full shell access, file read/write, autonomous multi-step execution. Can run any command, install packages, modify system files, and push to git — all without mandatory human approval

  Operator note: Use permission mode (--allowedTools) to restrict which tools Claude Code can use. Run in a sandboxed environment or container for untrusted repos. Review git diffs before allowing pushes. Set CLAUDE.md rules to constrain behavior per-project.
• codecompanion.nvim cli mixed egress
  Capabilities: reads filesnetwork
  via multiple · api.openai.com, api.anthropic.com, generativelanguage.googleapis.com
  What it does: Chat/agentic coding plugin for Neovim with configurable OpenAI-compatible adapters — sends buffer context to whichever backend is configured

  Operator note: Audit the adapters table in the plugin's Lua config under ~/.config/nvim. Use local models (Ollama) for sensitive codebases.
• GitHub Copilot CLI cli cloud egress
  Capabilities: runs shellnetwork
  via openai · api.openai.com, copilot-proxy.githubusercontent.com
  What it does: AI-powered CLI suggestions — translates natural language to shell commands, can suggest destructive commands

  Operator note: Always review generated commands before executing. Avoid piping directly to shell.
• LLM CLI (Simon Willison) cli mixed egress
  Capabilities: networkruns shell
  via multiple · api.openai.com, api.anthropic.com
  What it does: Command-line LLM client — sends prompts to configured provider. Supports plugins for tool use

  Operator note: Review installed plugins. Be cautious piping sensitive data.
• Open Interpreter cli cloud egress
  Capabilities: reads fileswrites filesruns shellnetworkbrowsersystem_settings
  via multiple · api.openai.com, api.anthropic.com
  What it does: AI agent with FULL system access — can execute arbitrary code, install software, access files, browse web, and control your computer autonomously

  Operator note: Never run in production environments. Use --safe-mode. Run in a sandboxed VM/container. Review every code execution before approval.
• OpenAI Codex CLI cli cloud egress
  Capabilities: reads fileswrites filesruns shellnetworkgit
  via openai · api.openai.com
  What it does: OpenAI's CLI agent — full shell access, autonomous code generation, file read/write, and multi-step execution

  Operator note: Use sandbox mode. Review all file changes before accepting. Set execution limits.
• Shell-GPT cli cloud egress
  Capabilities: runs shellnetwork
  via openai · api.openai.com
  What it does: AI shell assistant — can generate and execute shell commands based on natural language, with direct shell execution mode

  Operator note: Avoid --execute mode for untrusted prompts. Review generated commands before running. Don't pipe sensitive data.
• Supermaven (CLI) cli cloud egress
  Capabilities: networkreads files
  via supermaven · supermaven.com
  What it does: Fast autocomplete model — sends nearby file context to Supermaven's servers

  Operator note: Use Supermaven Team for SOC2-compliant processing. Disable in sensitive repos.
• Warp Terminal cli cloud egress
  Capabilities: runs shellnetworkclipboard
  via multiple · api.warp.dev
  What it does: Terminal with AI command suggestions — sends command context to Warp cloud for AI-powered completions and explanations

  Operator note: Review AI-suggested commands before executing. Be cautious with sensitive environment variables visible in terminal.
• ComfyUI creative_tool none egress
  Capabilities: networkreads fileswrites files
  via local · localhost:8188
  What it does: Node-based image generation — custom nodes can execute arbitrary code

  Operator note: Audit installed custom nodes. Keep bound to localhost. Don't install untrusted nodes.
• Fooocus creative_tool none egress
  Capabilities: networkreads fileswrites files
  via local · localhost:7865
  What it does: Simplified local image generation — minimal extension system, lower risk

  Operator note: Keep bound to localhost.
• InvokeAI creative_tool none egress
  Capabilities: networkreads fileswrites files
  via local · localhost:9090
  What it does: Local image generation with structured workflow — limited extension capabilities

  Operator note: Keep bound to localhost.
• Stable Diffusion WebUI creative_tool none egress
  Capabilities: networkreads fileswrites files
  via local · localhost:7860
  What it does: Local image generation with web UI — extensions can add arbitrary functionality including internet access

  Operator note: Audit installed extensions. Keep bound to localhost. Don't install untrusted extensions.
• ChatGPT Desktop desktop_app cloud egress
  Capabilities: networkbrowser
  via openai · api.openai.com
  What it does: Plugin/action system can access external services, send data to third-party APIs, and execute multi-step workflows

  Operator note: Disable unused plugins. Review plugin permissions before enabling. Avoid pasting sensitive data into conversations with plugins active.
• Claude Desktop desktop_app cloud egress
  Capabilities: networkreads fileswrites filesbrowser
  via anthropic · api.anthropic.com
  What it does: MCP tool use can execute arbitrary actions — file I/O, web requests, and shell commands via installed MCP servers

  Operator note: Audit installed MCP servers regularly. Remove unused servers. Use allowlists for permitted tool actions. Monitor with AariaSec proxy.
• Codex desktop_app cloud egress
  Capabilities: reads fileswrites filesruns shellnetworkgit
  via openai · chatgpt.com, api.openai.com
  What it does: Desktop coding agent with file read/write, shell execution, multi-step autonomous behavior, and broad codebase access

  Operator note: Review execution prompts carefully. Keep AariaSec monitoring enabled. Use scoped workspaces and approval checks for sensitive repos.
• Goose (Block) desktop_app cloud egress
  Capabilities: reads fileswrites filesruns shellnetworkgit
  via multiple · api.openai.com, api.anthropic.com
  What it does: Autonomous AI agent by Block — full shell access, file read/write, MCP tool use, and multi-step autonomous execution without mandatory human approval

  Operator note: Review installed MCP extensions. Restrict shell access in Goose settings. Monitor tool invocations. Run in sandboxed environment for untrusted tasks.
• Perplexity desktop_app cloud egress
  Capabilities: networkbrowser
  via multiple · www.perplexity.ai, api.perplexity.ai
  What it does: Search-augmented LLM — primarily read-only web queries, limited local file access

  Operator note: Avoid pasting sensitive data. Review search context before sharing conversations.
• Pieces for Developers desktop_app cloud egress
  Capabilities: networkreads files
  via multiple · api.openai.com, api.anthropic.com
  What it does: Code snippet manager with AI features — indexes local code snippets and sends to cloud LLM for enrichment

  Operator note: Review which snippets are synced. Disable cloud features for sensitive code. Use local-only mode if available.
• Raycast (AI Features) desktop_app cloud egress
  Capabilities: networkreads filesclipboardsystem_settings
  via multiple · api.openai.com, api.anthropic.com
  What it does: Launcher with AI extensions — can access clipboard, files, and system commands via AI-powered workflows

  Operator note: Audit installed Raycast extensions. Disable AI features for sensitive workflows. Review clipboard access.
• Spark Mail (AI) desktop_app cloud egress
  Capabilities: network
  via multiple · api.openai.com
  What it does: Email client with AI compose/summarize — sends email content to cloud LLM for processing

  Operator note: Disable AI features for sensitive email threads. Review AI-generated responses before sending.
• Amazon Q Developer ide cloud egress
  Capabilities: reads filesnetwork
  via multiple · codewhisperer.us-east-1.amazonaws.com
  What it does: AWS AI coding assistant — sends code context to AWS for suggestions, can generate code and interact with AWS services

  Operator note: Review IAM permissions. Disable for non-AWS projects. Review suggested code before accepting.
• Antigravity (Google) ide enterprise_cloud egress
  Capabilities: reads fileswrites filesruns shellnetworkgit
  via google · generativelanguage.googleapis.com, cloudcode-pa.googleapis.com
  What it does: Google AI IDE with full codebase access, autonomous code generation, terminal execution, and built-in Gemini integration. Sends code context to Google Cloud servers

  Operator note: Review which workspaces are open. Audit installed extensions. Be cautious with proprietary code — context is sent to Google Cloud for AI features.
• Augment Code ide cloud egress
  Capabilities: reads fileswrites filesruns shellnetworkgit
  via anthropic · augmentcode.com, api.augmentcode.com, api.anthropic.com
  What it does: Enterprise coding agent specifically built for large monorepos. Ingests entire repo for context — high-volume code egress posture.

  Operator note: Use workspace allow-list. Review which repos are indexed. Enable SAML SSO + audit log integration on the enterprise plan.
• Blackbox AI (VS Code) ide cloud egress
  Capabilities: networkreads files
  via blackbox · api.blackbox.ai, www.blackbox.ai
  What it does: Inline code completion and search — sends code context to Blackbox AI's cloud. Data retention and training policies are less transparent than major providers.

  Operator note: Review Blackbox's privacy policy. Disable for repos with proprietary code. Consider switching to a provider with clearer data-use terms.
• Cline (Claude Dev) ide cloud egress
  Capabilities: reads fileswrites filesruns shellnetworkbrowsergit
  via multiple · api.anthropic.com, api.openai.com
  What it does: Autonomous AI coding agent in VS Code — can create/edit/delete files, run terminal commands, and browse the web without per-action approval

  Operator note: Enable approval mode for file changes. Review terminal commands before execution. Set spending limits on API usage.
• Codeium ide cloud egress
  Capabilities: networkreads files
  via codeium · server.codeium.com
  What it does: Inline code completion and chat — sends file context to Codeium's servers

  Operator note: Codeium offers a self-hosted Enterprise plan. For individuals, disable in regulated repos via .codeiumignore.
• Continue for JetBrains ide mixed egress
  Capabilities: reads filesnetwork
  via multiple · api.openai.com, api.anthropic.com
  What it does: Continue's JetBrains plugin mirrors the VS Code extension's configurable-backend design — sends code context to whichever LLM provider is configured in its config.json, including self-hosted models

  Operator note: Audit which model provider is configured in the plugin's config.json. Use local models (Ollama) for sensitive codebases.
• Continue.dev ide mixed egress
  Capabilities: reads filesnetworkgit
  via multiple · api.openai.com, api.anthropic.com
  What it does: Code assistant with configurable model backends — sends code context to whichever LLM provider is configured, including self-hosted models

  Operator note: Audit which model provider is configured. Use local models (Ollama) for sensitive codebases. Review context window to ensure secrets aren't included.
• Cursor IDE ide cloud egress
  Capabilities: reads fileswrites filesruns shellnetworkgit
  via multiple · api.openai.com, api.anthropic.com
  What it does: Full codebase access + autonomous code generation + terminal execution. Can read/write any file in your project and run shell commands

  Operator note: Use workspace-scoped permissions. Review AI-generated diffs before accepting. Avoid opening repos with secrets in environment files. Enable Cursor's confirmation prompts for terminal commands.
• GitHub Copilot (VS Code) ide cloud egress
  Capabilities: reads filesnetworkruns shellgit
  via openai · api.openai.com, copilot-proxy.githubusercontent.com
  What it does: Sends code context to cloud for suggestions. Copilot Chat can run terminal commands. Full repository context sent to GitHub servers

  Operator note: Use .copilotignore to exclude sensitive files. Disable Copilot for repos with proprietary code. Review Copilot Chat suggestions before executing terminal commands.
• JetBrains AI Assistant ide cloud egress
  Capabilities: networkreads fileswrites files
  via multiple · api.jetbrains.com
  What it does: AI Assistant reads your codebase for context, generates code, and (with Junie) can autonomously edit multiple files

  Operator note: Enable AI Assistant per-project. Junie (agent mode) should only be used on codebases you're willing to diff carefully.
• Kiro (Amazon) ide cloud egress
  Capabilities: reads fileswrites filesruns shellnetworkgit
  via anthropic · api.anthropic.com, bedrock-runtime.us-east-1.amazonaws.com, bedrock-runtime.us-west-2.amazonaws.com
  What it does: Amazon's AI-native IDE — autonomous spec-driven coding with file read/write, shell execution, and multi-step agentic loops. Routes to Anthropic Claude via Bedrock or direct.

  Operator note: Use workspace-scoped permissions. Review AI-generated diffs before accepting. Avoid opening repos with credentials in environment files. Enable Kiro's per-action approval for terminal commands.
• PearAI ide cloud egress
  Capabilities: reads fileswrites filesnetworkgit
  via multiple · api.openai.com, api.anthropic.com
  What it does: AI-native IDE with autonomous coding capabilities — sends codebase context to cloud LLM

  Operator note: Review AI actions before accepting. Use workspace-scoped settings.
• Pieces for VS Code ide cloud egress
  Capabilities: reads filesnetwork
  via multiple · api.openai.com
  What it does: Code snippet copilot — indexes and sends code context to cloud for AI-powered enrichment

  Operator note: Review which snippets are saved. Disable cloud sync for sensitive code.
• ProxyAI (CodeGPT) for JetBrains ide mixed egress
  Capabilities: reads filesnetwork
  via multiple · api.openai.com, api.anthropic.com, generativelanguage.googleapis.com
  What it does: ProxyAI (formerly CodeGPT) runs inside JetBrains IDEs and lets the user point at a custom/self-hosted model base URL — code context is sent to whichever provider is configured, including third-party proxies outside JetBrains' own AI Assistant

  Operator note: Audit the custom base URL under the plugin's provider settings. Prefer a monitored/first-party endpoint. Review context scope before enabling on sensitive repos.
• Roo Code ide cloud egress
  Capabilities: reads fileswrites filesruns shellnetworkgit
  via multiple · api.anthropic.com, api.openai.com
  What it does: Autonomous AI coding agent (Cline fork) — full file system and terminal access with multi-step execution

  Operator note: Enable approval mode. Review all file changes before accepting. Monitor terminal command execution.
• Sourcegraph Cody ide cloud egress
  Capabilities: reads filesnetworkgit
  via multiple · sourcegraph.com
  What it does: Full codebase indexing with cloud processing — your entire repository is indexed and searchable on Sourcegraph servers

  Operator note: Use Sourcegraph's self-hosted option for proprietary code. Configure repo-level access controls. Exclude sensitive repos from indexing via .cody/ignore.
• Supermaven ide cloud egress
  Capabilities: reads filesnetwork
  via multiple · api.supermaven.com
  What it does: AI code completion with large context window — sends extensive code context to cloud for suggestions

  Operator note: Review which files are included in context. Disable for sensitive repositories.
• Tabnine ide mixed egress
  Capabilities: reads filesnetwork
  via multiple · api.tabnine.com
  What it does: AI code completion — sends code context to Tabnine cloud or local model for suggestions

  Operator note: Use Tabnine's local model for sensitive code. Configure code privacy settings. Review completions before accepting.
• Trae (ByteDance) ide cloud egress
  Capabilities: reads fileswrites filesruns shellnetworkgit
  via multiple · api.openai.com
  What it does: ByteDance AI IDE — data jurisdiction concerns, full codebase access, autonomous code generation with file system writes

  Operator note: Review data privacy policy. Consider data jurisdiction implications. Avoid use on proprietary codebases.
• Void Editor ide mixed egress
  Capabilities: reads fileswrites filesnetworkgit
  via multiple · api.openai.com, api.anthropic.com
  What it does: Open-source AI code editor — sends code context to configured model provider

  Operator note: Use local models where possible. Review AI-generated code before accepting.
• Windsurf (Codeium) ide cloud egress
  Capabilities: reads fileswrites filesruns shellnetworkgit
  via multiple · api.codeium.com
  What it does: Autonomous coding agent with file system access — can create, modify, and delete files across your project without per-action approval

  Operator note: Use project-scoped workspaces. Review Cascade agent actions in the activity log. Keep version control active so changes can be reverted.
• Zed Editor ide mixed egress
  Capabilities: reads filesnetworkgit
  via multiple · api.openai.com, api.anthropic.com
  What it does: AI-powered code editor with inline assistant — sends code context to configured LLM provider

  Operator note: Configure which LLM provider to use. Review AI suggestions before accepting. Use local models for sensitive code.
• AnythingLLM local_llm mixed egress
  Capabilities: networkreads files
  via multiple · api.openai.com, api.anthropic.com, localhost:11434
  What it does: Local RAG application that ingests documents (PDFs, Word files, code) and sends them to whichever LLM provider is configured — cloud providers receive full document content.

  Operator note: Use Ollama (local) as the LLM provider for sensitive documents. Audit which LLM backend is configured in Settings. Don't ingest classified files when a cloud provider is active.
• GPT4All local_llm none egress
  Capabilities: network
  via local · localhost:4891
  What it does: Local LLM runner — runs models entirely on your machine, no cloud connection

  Operator note: Keep local API server bound to localhost if enabled.
• Jan local_llm none egress
  Capabilities: network
  via local · localhost:1337
  What it does: Open-source local AI assistant — runs models locally with optional remote API access

  Operator note: Disable remote model access for air-gapped use. Keep API server on localhost.
• KoboldCpp local_llm none egress
  Capabilities: network
  via local · localhost:5001
  What it does: Local LLM inference via llama.cpp — web UI + API server

  Operator note: Keep bound to localhost. Don't expose publicly.
• LM Studio local_llm none egress
  Capabilities: network
  via local · localhost:1234
  What it does: Local LLM inference with OpenAI-compatible API — no data egress by default

  Operator note: Keep server bound to localhost. Don't expose on 0.0.0.0 without authentication.
• LocalAI local_llm none egress
  Capabilities: network
  via local · localhost:8080
  What it does: Self-hosted OpenAI-compatible API — local inference only

  Operator note: Keep bound to localhost. Add authentication for network exposure.
• Ollama local_llm none egress
  Capabilities: network
  via local · localhost:11434
  What it does: Local inference only — no data leaves your machine by default. Risk increases if exposed on 0.0.0.0 or used by agentic frameworks

  Operator note: Keep Ollama bound to localhost (default). If using with LangChain/CrewAI, monitor the calling framework instead.
• Open WebUI local_llm none egress
  Capabilities: network
  via local · localhost:3000, localhost:8080, localhost:11434
  What it does: Web frontend for Ollama and OpenAI-compatible APIs — if not bound to localhost it exposes your local LLM (and any connected cloud APIs) to the network without authentication by default.

  Operator note: Keep bound to 127.0.0.1. Enable authentication in Open WebUI settings. Don't expose port 3000/8080 on the firewall. Pin to a specific Ollama model to avoid accidental cloud API calls.
• Text Generation Inference (HF) local_llm none egress
  Capabilities: network
  via local · localhost:8080
  What it does: Hugging Face local model serving — optimized inference server

  Operator note: Keep bound to localhost. Use authentication tokens for network access.
• vLLM local_llm none egress
  Capabilities: network
  via local · localhost:8000
  What it does: High-throughput local LLM serving — OpenAI-compatible API, no data egress

  Operator note: Bind to localhost only. Add authentication if exposed on network.
• Agent-Smith (0x0pointer) offensive-security-agent cloud+local egress
  Capabilities: networkspawns processesdocker execreads files
  via multi · api.openai.com, api.anthropic.com, localhost:11434
  What it does: LLM-driven autonomous attack path synthesis. Reads security skill descriptions and generates exploit chains via MCP tool calling. Docker-sandboxed but visible at network egress layer.

  Operator note: Flag immediately on detection regardless of declared purpose. Cross-reference egress against _PASSIVE_RECON_DESTINATIONS and _SUPPLY_CHAIN_DESTINATIONS (AWR-158, AWR-161). MCP tool-call patterns will match AWR-166 coherence mismatch for non-security agents.
• Rewind / Limitless os_ai cloud egress
  Capabilities: networkwrites filescamera_micsystem_settings
  via openai · api.openai.com, api.limitless.ai
  What it does: macOS app that continuously records your screen and microphone, compresses and stores locally, then uses GPT-4 to answer questions about your past activity. All summarisation queries go to OpenAI. Full screen content (including passwords, keys, proprietary docs) is captured.

  Operator note: Pause Rewind/Limitless during sensitive work (keyboard shortcut available). Exclude apps in Preferences → Excluded Apps. Disable microphone recording if not needed. Review OpenAI data retention for your queries.
• Windows Recall (Copilot+) os_ai local egress
  Capabilities: writes filessystem_settingscamera_mic
  via microsoft · api.cognitive.microsoft.com
  What it does: Windows 11 Copilot+ feature that takes a screenshot every few seconds and indexes everything visible on screen using a local NPU. The semantic index is stored unencrypted on disk and accessible to any process running as the user — including malware. Covers all apps, all windows, all typed text.

  Operator note: Disable Recall in Windows Settings → Privacy & Security → Recall & Snapshots. Enterprise: use MDM policy (AllowRecall=0). Exclude sensitive apps via Recall's filter list. At minimum, enable the 'Require PIN to access Recall' setting.
• Adobe Acrobat (AI Assistant) productivity cloud egress
  Capabilities: networkreads files
  via multiple · acrobatservices.adobe.com, dc-api.adobe.io
  What it does: Adobe AI Assistant (available in Acrobat DC 2024+) can read and summarise entire PDF documents, including sensitive contracts, financial reports, and medical records — document text is sent to Adobe's cloud AI endpoints.

  Operator note: Disable AI features in Acrobat Preferences → AI. Enterprise admins can restrict AI services via ADMX policy (AdobeAcrobatAIServices=0). Avoid using AI Assistant with classified or PII-heavy documents.
• Atlassian Rovo productivity cloud egress
  Capabilities: reads filesnetwork
  via anthropic · atlassian.com, atlassian.net, api.atlassian.com
  What it does: AI search + chat + agents across Jira / Confluence / Trello plus connected sources (Drive, Slack, GitHub). Reads everything the user can read. Browser-delivered primarily; no unique desktop process — detect via proxy traffic to *.atlassian.com with Rovo headers.

  Operator note: Enforce ACL inheritance — Rovo must respect per-page/per-issue permissions. Audit which connected sources are enabled. Restrict Rovo Agents creation to admins.
• Fathom (Meeting AI) productivity cloud egress
  Capabilities: reads filesnetwork
  via openai · fathom.video, api.fathom.video
  What it does: Free-tier meeting AI growing in mid-market. Records Zoom + Meet + Teams. Transcripts + AI summaries shared via simple link — potential accidental disclosure vector.

  Operator note: Enforce SSO. Disable public link sharing. Audit retention policy.
• Fellow.ai productivity cloud egress
  Capabilities: reads filesnetwork
  via multiple · fellow.app, api.fellow.app
  What it does: AI meeting assistant with native Microsoft Teams integration (#1 for Teams per industry reviews). 8000+ Zapier app connections — broad downstream egress.

  Operator note: Audit Zapier integrations. Restrict by meeting type (no sensitive meetings auto-transcribed).
• Fireflies.ai productivity cloud egress
  Capabilities: reads filesnetwork
  via multiple · fireflies.ai, api.fireflies.ai
  What it does: Cross-platform meeting AI (Zoom/Teams/Meet/Webex). Records, transcribes, summarizes. 50+ integrations feed meeting data into CRM and project tools — wide downstream egress.

  Operator note: Audit which integrations are enabled. Disable for meetings discussing PII, financials, or M&A. Review retention policy — Fireflies stores transcripts by default.
• Glean (Enterprise Search) productivity cloud egress
  Capabilities: reads filesnetwork
  via multiple · glean.com, scio.glean.com
  What it does: Enterprise search across 100+ workplace apps (Slack, Drive, Salesforce, Notion, GitHub, Confluence). Reads everything the user can read — effectively a superuser search index. Desktop app + Chrome extension.

  Operator note: Enforce identity-mapped permissions — Glean must inherit per-user ACLs from each connected source. Audit which sources are indexed. Disable for highly-classified workspaces.
• Grammarly (AI Suite) productivity cloud egress
  Capabilities: networkreads files
  via grammarly · api.grammarly.com
  What it does: Reads every text field you type into, including password fields in some contexts — sends text to Grammarly's cloud for suggestions and generative rewrites

  Operator note: Turn off GrammarlyGO rewrites for regulated workflows. Exclude sensitive apps in Grammarly settings.
• Granola productivity cloud egress
  Capabilities: networkcamera_micwrites files
  via openai · api.openai.com, api.granola.ai
  What it does: macOS meeting note-taker that captures system audio from ALL apps (including calls not in a browser) and sends transcripts to OpenAI GPT-4 for summarisation. Captures any audio output on the machine.

  Operator note: Disable audio capture when not in meetings. Review which calls Granola is permitted to record. Check that participants are aware. Pause before discussions of trade secrets.
• Harvey AI productivity cloud egress
  Capabilities: reads fileswrites filesnetwork
  via multiple · harvey.ai, app.harvey.ai, api.openai.com, api.anthropic.com
  What it does: Legal AI used by top-tier law firms ($11B valuation, March 2026). Operates on privileged documents — contracts, due-diligence material, litigation prep. Browser-delivered; detect via proxy traffic to harvey.ai with attached document uploads.

  Operator note: Treat as a privileged-data channel. Require DLP review on every document uploaded. Restrict access by matter/case ID. Audit which documents each user uploaded.
• Hebbia (Finance/Legal AI) productivity cloud egress
  Capabilities: reads fileswrites filesnetwork
  via multiple · hebbia.com, app.hebbia.com
  What it does: Finance and legal enterprise search on proprietary documents — investment memos, deal data, regulatory filings. Heavy-document workflows. Browser-delivered; detect via proxy traffic to hebbia.com with file uploads.

  Operator note: Treat as a regulated-data channel. Require DLP review on every document. Restrict by deal/matter. Hash and log every upload for compliance retention.
• Jamie (meetjamie.ai) productivity selective egress
  Capabilities: reads filesnetwork
  via multiple · meetjamie.ai, api.meetjamie.ai
  What it does: Privacy-first meeting AI — runs on the device, no meeting bot joining the call. Important for regulated industries. Lower egress than Fireflies/Fathom but transcripts still leave the device for AI processing.

  Operator note: Verify the local-vs-cloud processing claim per plan tier. Audit retention.
• Microsoft 365 Copilot productivity enterprise_cloud egress
  Capabilities: networkreads fileswrites files
  via openai · graph.microsoft.com
  What it does: Reads mail, docs, calendar, and chats to generate and summarise — tenant-scoped but broad data access inside the scope

  Operator note: Tenant admins can scope Copilot by role. Disable access to sensitive SharePoint sites.
• Microsoft Copilot Studio productivity cloud egress
  Capabilities: reads filesnetwork
  via openai · copilotstudio.microsoft.com, powerplatform.microsoft.com
  What it does: Microsoft's agent builder. Distinct from M365 Copilot — it lets users author custom agents that connect to internal data sources (SharePoint, Dataverse, Graph). Authored agents inherit author's data scope.

  Operator note: Restrict who can publish Copilot Studio agents (admin policy). Audit which connectors each published agent uses. Monitor egress to graph.microsoft.com from agents.
• Microsoft Teams Copilot productivity cloud egress
  Capabilities: reads filesnetwork
  via openai · teams.microsoft.com, graph.microsoft.com
  What it does: Teams-specific surface of Microsoft Copilot — summarizes meetings, drafts replies, recaps chats. Distinct from M365 Copilot suite-level entry. Shares the Teams process; detect via Graph traffic with copilot scope headers.

  Operator note: Disable Copilot for sensitive Teams channels. Enforce Data Boundary policies. Audit Copilot interaction logs in M365 admin center.
• Notion (Notion AI) productivity cloud egress
  Capabilities: networkreads files
  via multiple · api.notion.com
  What it does: Notion AI reads your workspace content to summarise, translate, and generate — page text is sent to Notion's LLM providers

  Operator note: Admin workspaces can disable Notion AI at the workspace level. Audit which users have AI features enabled.
• Obsidian (AI plugins) productivity cloud egress
  Capabilities: networkreads files
  via multiple · api.openai.com, api.anthropic.com
  What it does: Community AI plugins (Copilot, Smart Connections, Text Generator) can send note contents to third-party LLMs

  Operator note: Review installed community plugins under Settings → Community plugins. Plugins can be disabled per-vault.
• Otter.ai productivity cloud egress
  Capabilities: networkcamera_micwrites files
  via otter · api.otter.ai, otter.ai
  What it does: Continuously records and transcribes meeting audio — full conversation transcript (including sensitive business discussions) is stored on Otter's cloud and used to train AI models unless opted out.

  Operator note: Notify all meeting participants before recording. Opt out of AI training in Settings → Privacy. Disable auto-join for calendar meetings. Use Business plan for stricter data controls.
• Read AI productivity cloud egress
  Capabilities: reads filesnetwork
  via multiple · read.ai, api.read.ai
  What it does: Meeting + email AI. Reads inbox content (Gmail/Outlook integrations) in addition to meeting recordings. Broader scope than meeting-only competitors.

  Operator note: Audit which integrations are connected. Disable inbox-read for users handling regulated correspondence.
• Salesforce Agentforce 360 productivity cloud egress
  Capabilities: reads fileswrites filesnetwork
  via multiple · api.salesforce.com, einstein.ai.salesforce.com
  What it does: Enterprise agent layer over Salesforce CRM. Reads every customer record + opportunity + case. Can autonomously update records and trigger workflows. Mostly browser-delivered; desktop CRM if installed touches the same data.

  Operator note: Treat as a regulated-data egress channel. Audit which CRM objects each agent persona can read. Enforce Field-Level Security and Profile-based data access.
• ServiceNow Now Assist productivity cloud egress
  Capabilities: reads filesnetwork
  via multiple · service-now.com
  What it does: Native AI across the ServiceNow platform — ITSM, HR, procurement, security ops. Reads every ticket and asset record. Browser-delivered; no unique desktop process — detect via proxy traffic to *.service-now.com with model headers.

  Operator note: Apply ACL roles to which tables Now Assist can read. Disable for highly-classified HR/security records. Audit Now Assist response logs.
• Slack AI productivity cloud egress
  Capabilities: reads filesnetwork
  via anthropic · slack.com, edgeapi.slack.com
  What it does: Salesforce-native AI inside Slack desktop. Reads channel history, threads, and DMs to summarize and answer. Shares the Slack process — AI activity not distinguishable from regular Slack at the process level (detect via traffic patterns to edgeapi.slack.com with AI feature headers).

  Operator note: Disable Slack AI for channels containing PII/financials/M&A. Restrict 'Recap' and 'Search Answers' per channel access. Audit who can see AI-generated summaries.
• Zoom AI Companion / Zoomie productivity cloud egress
  Capabilities: reads filesnetwork
  via multiple · zoom.us, ai.zoom.us
  What it does: Native AI inside Zoom Workplace. New 'Zoomie' agentic facilitator (March 2026) operates across Zoom Rooms, Meetings, Chat, and Zoom Phone. Massive install base — any enterprise on Zoom Workplace has this surface.

  Operator note: Enable account-level AI Companion governance. Restrict which meeting types record transcripts. Audit per-user usage in Zoom Admin Portal.
• Anthropic Python SDK sdk cloud egress
  Capabilities: network
  via anthropic · api.anthropic.com
  What it does: Direct API access with tool use capability. Applications can define and execute arbitrary tools, including shell commands and file operations

  Operator note: Implement strict tool allowlists. Validate all tool inputs server-side. Use Anthropic's usage limits and monitor API spend. Sandbox tool execution.
• Cohere SDK sdk cloud egress
  Capabilities: network
  via cohere · api.cohere.ai, api.cohere.com
  What it does: Cohere API access with RAG and tool use capabilities

  Operator note: Validate RAG outputs. Restrict connector access. Monitor usage.
• DeepSeek SDK sdk cloud egress
  Capabilities: network
  via deepseek · api.deepseek.com
  What it does: DeepSeek API — data jurisdiction concerns (China-based), cloud inference with tool use

  Operator note: Review data privacy policy. Consider data jurisdiction implications. Avoid for sensitive data.
• DSPy sdk cloud egress
  Capabilities: network
  via multiple · api.openai.com, api.anthropic.com
  What it does: Stanford framework for programming LLM pipelines — optimises prompts and chains automatically by calling the LLM API many times during compilation.

  Operator note: Set compile-time API call budgets. Avoid running DSPy optimisation on sensitive data pipelines.
• Fireworks AI SDK sdk cloud egress
  Capabilities: network
  via fireworks · api.fireworks.ai
  What it does: Fireworks AI API — cloud LLM inference with function calling support

  Operator note: Monitor usage. Validate outputs.
• Google GenAI SDK sdk cloud egress
  Capabilities: network
  via google · generativelanguage.googleapis.com
  What it does: Google Gemini API access — function calling and code execution capabilities

  Operator note: Validate function call outputs. Restrict API key permissions. Monitor usage.
• Groq SDK sdk cloud egress
  Capabilities: network
  via groq · api.groq.com
  What it does: Groq API access — high-speed LLM inference with function calling

  Operator note: Monitor usage. Validate function call outputs.
• Instructor (structured outputs) sdk cloud egress
  Capabilities: network
  via multiple · api.openai.com, api.anthropic.com
  What it does: Structured LLM output library — commonly used in production pipelines and agentic systems. Patches the OpenAI/Anthropic client, so any data passed to it goes to the configured provider.

  Operator note: Ensure correct provider is configured. Don't pass PII or secrets in structured extraction calls. Monitor API usage.
• Mistral AI SDK sdk cloud egress
  Capabilities: network
  via mistral · api.mistral.ai
  What it does: Mistral API access with function calling support

  Operator note: Validate function call parameters. Monitor API spend.
• OpenAI Python SDK sdk cloud egress
  Capabilities: network
  via openai · api.openai.com
  What it does: Direct API access with function calling capability. Applications built with this SDK can execute arbitrary tool calls depending on implementation

  Operator note: Validate and sanitize all function call parameters. Use OpenAI's moderation API for user-facing apps. Implement rate limiting and cost caps on API keys.
• Replicate SDK sdk cloud egress
  Capabilities: network
  via replicate · api.replicate.com
  What it does: Cloud model hosting — runs arbitrary ML models on Replicate infrastructure

  Operator note: Review model permissions. Monitor usage and costs.
• Together AI SDK sdk cloud egress
  Capabilities: network
  via together · api.together.xyz
  What it does: Together AI API — runs open-source models in cloud with function calling

  Operator note: Monitor model usage and costs. Validate outputs.
• ElevenLabs SDK voice cloud egress
  Capabilities: networkcamera_mic
  via elevenlabs · api.elevenlabs.io
  What it does: Cloud text-to-speech and voice cloning — sends text and audio data to ElevenLabs servers

  Operator note: Don't use with sensitive text content. Review voice cloning consent requirements.
• Krisp (AI Voice/Transcription) voice selective egress
  Capabilities: network
  via multiple · krisp.ai, api.krisp.ai
  What it does: AI noise cancellation + meeting transcription. Sits in the audio stack between OS and meeting apps — sees every call. Local processing for noise cancel, but transcripts can route to cloud.

  Operator note: Disable transcript upload if local-only is required. Audit per-meeting whether transcripts left the device.
• OpenAI Whisper voice none egress
  Capabilities: camera_mic
  via local ·
  What it does: Local speech-to-text — runs entirely on your machine, no cloud connection

  Operator note: No mitigation needed for local use.
• Superwhisper voice cloud egress
  Capabilities: networkcamera_mic
  via openai · api.openai.com
  What it does: System-wide voice dictation that transcribes microphone input and optionally rewrites text via GPT-4. Microphone audio and transcripts sent to OpenAI for cloud-mode transcription.

  Operator note: Use local Whisper mode (no egress). Disable cloud rewriting for sensitive dictation. Review microphone permissions.