Solutions · By initiative
Signals Corps shows every agent, skill, plugin, connector, and identity on each device, so IT can approve a supported set and block the rest.
device:endpoint_4c19 trust:any⌘↵New agent found · Unreviewed
Critical finding · Blocked · Applied
Identified · Trusted
The problem
Each team installs its own agents and copies skills and connectors from public marketplaces, and nobody chose most of them.
Sales uses the Claude desktop app, engineering uses three coding agents, and someone in finance found a connector on a public marketplace. Each one can read files, run commands, or reach company data with its user's access. The more of them there are, the more there is to review, patch, and explain after an incident.
Research from across the industry shows how much of it nobody chose.
of office professionals have used AI tools at work that they believed company policy didn't allow.
Survey of 1,250 professionals at companies with $500 million or more in revenue, in the US, UK, Australia, and Japan.
An approved list needs a way to see who uses something else.
PagerDuty and Wakefield Research, June 2026
of agent skills scanned had at least one security flaw.
1,467 of 3,984 skills from ClawHub and skills.sh; 534 had a critical issue.
Every unreviewed skill you remove is one fewer flaw to worry about.
Snyk ToxicSkills, February 2026
What changes
Control Plane lists every agent, skill, plugin, connector, and identity on every device, so you start from what teams actually use.
Mark the agents, skills, and connectors you support as trusted, or trust a publisher to approve its future versions too.
Filter Control Plane to anything outside the approved set and see which devices and teams use it, so you can move them over or add it to the list.
Block the skills and plugins you've decided against, and they stop loading on every device.
Where teams start
Pick the one that matches the problem in front of you, then add the others.
Choose the agents the company supports, see which devices run anything else, and move those teams over.
Trust the skills and connectors teams rely on, so they pick from a reviewed list instead of public marketplaces.
Find skills, plugins, and connectors installed on a handful of devices and never trusted, and block or remove them.
See which identities each agent can reach, and move agents off borrowed personal accounts and shared cloud profiles.
How it works
Push one package through your device management tool, such as Jamf, Iru, or Intune.
Trust the agents, skills, and connectors you'll support, and agree the list with each team.
Work through the exceptions team by team, then block the skills and plugins nobody should use. New components start unreviewed, so the list stays short.
Example deployment
Illustrative example
This company is fictional. The numbers come from a modelled fleet, not a customer.
Read the exampleWhat it costs
Supply Chain is priced per device, with free devices on every plan. Your bill depends on how many devices you cover, so heavier agent use doesn't change it, and finance can plan ahead.
Questions
Yes. Trust a publisher, and new versions of its skills and plugins are trusted too. Otherwise each new version waits for a decision.
Yes. A new skill appears as unreviewed in Control Plane as soon as someone installs it, so the install itself is the request.
Teams keep working with it while you decide. It stays unreviewed, and Control Plane lists it until someone trusts or blocks it.
Modules used
device:endpoint_4c19 trust:any⌘↵New agent found · Unreviewed
Critical finding · Blocked · Applied
Identified · Trusted
Supply Chain
See which AI agents run on each device and which identities they can reach, check the skills they load, and block what you don't trust.
Explore Supply ChainEarly access
Start reducing agent risk before general release by checking agent components, controlling agent actions, and hunting through your AI security logs. Signals Corps Control Plane opens to early sign ups in the next few weeks, so join the waitlist with your company email.