AI coding agents such as Claude Code and Cursor can access production databases, internal codebases, and sensitive repositories when developers grant them those permissions. Without centralized monitoring, security teams can have limited visibility into what data agents touch or what actions they take. As enterprises deploy AI coding assistants faster than they can govern them, MintMCP's Agent Monitor provides visibility into supported activity including prompts, file access, commands, MCP tool calls, usage, and token costs. Where supported by the client and hook phase, local hooks can surface or enforce actions before execution.

The challenge is real: developers can install coding agents, AI clients, and MCP servers locally, creating shadow AI activity that security teams may not see through centralized infrastructure. Without monitoring, organizations can struggle to determine which tools agents use, which files they access, and how sensitive systems are being reached. Federal guidelines on secure AI development emphasize the need for visibility and governance across automated systems accessing enterprise resources.

Key takeaways

• Claude Code and similar AI coding agents create governance challenges by accessing files, running commands, and calling tools without centralized visibility
• Agent Monitor provides visibility into supported prompts, file access, commands, MCP tool calls, usage, and token costs across coding-agent environments including Claude Code, Cursor, Codex, and GitHub Copilot
• Each autonomous agent should receive its own identity with scoped permissions through Agent Gateway rather than inheriting human credentials
• Runtime guardrails can detect and block risky agent actions including prompt injection, secrets exposure, and PII leakage
• Virtual MCPs centralize tool access behind governed endpoints with SSO, RBAC, and audit logging
• Audit trails, tamper-evident access history, and SIEM export support compliance reviews; MintMCP is SOC 2 Type II audited and compliant with HIPAA standards

1. Why Claude Code monitoring matters for enterprise security

AI coding agents operate with extensive system access. They read files including .env configurations and SSH keys. They execute bash commands and install packages. They call MCP tools that connect to production databases, GitHub repositories, and internal APIs. Without agent-specific monitoring, security teams can lack centralized visibility into these activities.

The shadow AI problem

Organizations face a proliferation of ungoverned AI tools:

• Developers install Claude Code and Cursor on their laptops and connect them directly to sensitive systems
• Each developer configures MCP servers locally, creating multiple installs, authentication flows, and potential failure points
• Credentials scatter across laptops where one leak can expose critical keys
• Security teams lack visibility into which AI tools are accessing what resources

What unmonitored agents can do

• Access production databases with queries that return customer PII
• Read environment files containing API keys and database credentials
• Execute shell commands that modify infrastructure
• Push code changes to repositories without human review
• Connect to internal tools using overprivileged service accounts

The governance gap

Traditional application performance monitoring tools track HTTP requests and database queries. They do not understand the AI agent workflow: which MCPs the agent called, what data it accessed, which credentials it used, and whether it followed policy. This gap leaves security teams without visibility into active users of enterprise data. NIST's AI Risk Management Framework highlights the importance of governance, traceability, and transparency for AI systems accessing organizational resources.

2. Key metrics and activities to track

Effective Claude Code monitoring requires capturing activity at multiple layers. Agent Monitor provides visibility into supported AI-agent activity including prompts, file access, commands, and token costs.

File operations

Track file read and write operations:

• Source code files and configuration
• Environment files (.env, .bashrc, SSH keys)
• Documentation and internal wikis
• Build artifacts and deployment scripts

Command execution

Monitor bash commands, package installations, and git operations:

• Shell commands and their arguments
• Package manager operations (npm install, pip install)
• Git commits, pushes, and branch operations
• Container and orchestration commands

MCP tool calls

Capture tool invocations through the Model Context Protocol:

• Which tools the agent called
• Arguments passed to each tool
• Data returned from connectors
• Timing and sequence of operations

Prompt submissions

Track supported prompt activity that drives agent behavior:

• User prompt submissions
• Prompt activity associated with supported sessions
• Prompt-related security events
• Patterns that correlate with risky actions

Usage and cost metrics

Attribute resource consumption to users, teams, and projects:

• Token spend by model (Claude, GPT, Gemini)
• Cost allocation by user, session, and agent
• Human versus agent usage split
• Cache hit rates for optimization

3. Tools for Claude Code monitoring

Several platforms address AI coding agent monitoring with different approaches and capabilities.

MintMCP Agent Monitor

MintMCP Agent Monitor provides real-time visibility into supported coding-agent activity across environments including Claude Code, Claude Cowork, Cursor, Codex, and GitHub Copilot. Lightweight local hooks can capture prompts, file access, commands, and MCP tool calls, with coverage and enforcement points varying by client and hook phase.

Core capabilities:

• Live activity feed showing supported agent activity across the organization in real time
• Filter by user, agent, tool, or time
• Built-in detection rules for secrets, prompt injection, and tool permissioning
• Custom rules using tool-argument and regex matching
• Supported actions can include, depending on the integration and enforcement point: flag, block, ask-user, mask, and Slack notify
• SIEM export via OTLP or Splunk HEC

Usage and cost tracking:

• Token spend by model, user, agent, and session
• Human versus agent split for chargeback
• Cache-hit rate visibility
• Project tagging for client billing

Organizations requiring cross-platform visibility rather than monitoring limited to one vendor can benefit from MintMCP's approach. The platform can provide visibility across multiple supported coding-agent environments rather than only one vendor's activity.

Obot

Obot provides an open-source AI control plane with MCP and LLM gateway capabilities, hosted AI workloads, access controls, and endpoint governance through Obot Sentry. Nanobot is a separate open-source MCP agent framework in the Obot ecosystem.

Primary focus:

• Open-source MCP and LLM gateway infrastructure
• Endpoint discovery and governance through Obot Sentry
• Identity, access control, and audit capabilities
• Self-hosted infrastructure options

Platform engineering teams that prioritize open-source or self-hosted AI infrastructure and are comfortable operating the underlying environment may find Obot suitable.

Portkey

Portkey provides AI Gateway capabilities with observability features including latency tracking, request tracing, and token cost monitoring. The platform was acquired by Palo Alto Networks.

Primary focus:

• Multi-LLM gateway across providers
• Observability for AI requests
• Guardrails and prompt management
• Enterprise security backing

Organizations operating multi-model environments requiring unified observability across LLM providers may find Portkey applicable.

Lasso Security

Lasso Security provides AI security across agent discovery, posture management, MCP governance, runtime protection, and adversarial testing.

Primary focus:

• Real-time prompt injection and agent-threat detection
• MCP discovery and risk scoring
• Role-based permissions, DLP, and runtime policy enforcement
• Automated AI red teaming capabilities

Organizations prioritizing security threat detection in AI deployments, particularly those in regulated industries handling sensitive data, may find Lasso Security relevant.

4. Setting up agent identities for governance

Every autonomous agent should get its own identity rather than operating through employee credentials or shared API keys. Agent Gateway treats autonomous agents as first-class non-human principals with their own credentials, permissions, and audit trails.

Why agent identity matters

Without dedicated identities, agents run on shared credentials that collapse the audit log, over-privilege the agent, and complicate rotation:

• Agent actions cannot be distinguished from human actions
• Credential rotation affects both human and agent access
• The agent inherits permissions beyond what it needs
• Audit trails show the human, not the agent that acted

Authentication mechanisms

Agent Gateway supports multiple authentication approaches:

Bearer keys:

• Static key on every request
• Named, expirable, individually revocable
• Suitable for internal agents with controlled access

M2M tokens:

• OAuth client-credentials exchange
• Short-lived tokens reduce exposure window
• Secret stays out of the request path

Workload identity federation:

• Agent's own infrastructure mints OIDC tokens
• Kubernetes service accounts, cloud roles, CI job identities
• MintMCP holds no secret at all

Scoped MCP access

Each agent identity connects to a Virtual MCP scoped to just that agent:

• Only the tools the agent needs
• Independent credential rotation
• Clean per-agent audit trail
• Isolation from other agents and users

5. Centralizing tool access with Virtual MCPs

MCP Gateway provides a single governed entrypoint between AI clients and MCP servers. The key abstraction is the Virtual MCP (VMCP): many connectors bundled behind one endpoint so users connect once instead of configuring each server.

How Virtual MCPs work

A Virtual MCP bundles approved connectors and a curated tool surface behind one governed endpoint for a particular team, role, use case, or agent. It serves as the unit of:

• Deployment
• Access control
• Tool curation
• Audit
• Administration

Connector options

MintMCP supports multiple connector types:

• Hosted connectors: Run in MintMCP's data plane with auto-scaling and sandboxed execution
• Remote connectors: Connect to existing MCP server deployments
• STDIO connectors: Wrap local STDIO servers with enterprise authentication
• Custom connectors: Build and deploy custom MCP servers

Credential management

Connectors never hold long-lived secrets. MintMCP injects credentials per call:

• Inline API keys for simple integrations
• Per-user OAuth for user-context operations
• Per-user AWS SSO for cloud resources
• Encrypted at rest with rotated AES keys

Role-based access control

Access is granted at the VMCP level and driven by directory groups via SCIM:

• Least privilege falls out of role design
• Tool curation trims context-window bloat
• Read-only versus read-write is just two VMCPs over the same connector
• Suspend in the IdP and access propagates

6. Implementing runtime guardrails

Visibility alone does not prevent incidents. Guardrails screen and control gateway tool calls on both the arguments the agent sends and the results the connector returns.

Mint Guard

Mint Guard provides centrally-maintained detection for:

• Prompt injection: Blocks at high confidence when malicious instructions appear in tool arguments or results
• Credentials and secrets: Detects API keys, passwords, and tokens in agent inputs and outputs
• PII: Identifies personally identifiable information before it flows through tools
• Harmful content: Screens for dangerous or inappropriate content

Mint Guard operates in three modes: Off, Monitoring, and Enforcing. Start in Monitoring to understand patterns, then switch to Enforcing for production protection.

Rules

Declarative rules match tool names, argument patterns, or content via regex. Supported actions can include, depending on the integration and enforcement point:

• Flag: Mark the action for review
• Block: Prevent the action from executing
• Ask-user: Require human confirmation
• Mask: Redact sensitive data
• Notify: Send alerts to Slack or other channels

Gateway middleware

Custom middleware runs in a JS sandbox on matching calls:

• Transform or redact sensitive data
• Call external classifiers or DLP systems
• Enforce resource allowlists
• Integrate with AWS Bedrock Guardrails, Google Cloud Model Armor, or OpenAI moderation

Middleware fails closed for policy-critical checks, ensuring that if the security system cannot evaluate a request, it blocks rather than allows.

7. Building audit trails for compliance

Organizations handling regulated data need detailed, verifiable records of AI agent activity. MintMCP logs tool calls, credential lifecycle events, and access-policy changes, while its audit and observability controls include tamper-evident access-grant history.

What gets logged

Every interaction creates an auditable record:

• Tool call details including arguments and results
• Credential usage and lifecycle events
• Access policy changes and approvals
• User and agent identity attribution
• Timestamps and session context

Tamper-evident history

Access-grant history is signed at write time and verifiable offline via published JWKS. This cryptographic signing enables:

• Unauthorized modifications to signed history to be detected
• Auditors to verify integrity independently
• Compliance teams to validate the integrity of access-grant history

SIEM integration

Export audit data to security information and event management systems using OpenTelemetry Protocol (OTLP) for modern observability stacks or Splunk HEC for Splunk deployments:

• Tool calls, prompt submissions, gateway requests
• Access-policy changes and credential events
• Integration with existing security operations workflows

Compliance alignment

MintMCP supports compliance requirements with:

• SOC 2 Type II audited controls
• Compliant with HIPAA standards (BAA available)
• Complete audit trails for regulatory reporting
• Role-based access logs for access reviews

8. Tracking costs and usage

AI agent spending can grow quickly without visibility. Token costs accumulate across models, users, and sessions. Usage tracking provides chargeback-grade attribution to manage costs.

Cost attribution

Track spending by multiple dimensions:

• By model: Compare costs across Claude, GPT, Gemini, and other providers
• By user: Identify high-usage individuals and teams
• By agent: Separate automated workloads from human interactions
• By session: Attribute costs to specific projects or tasks

Optimization insights

Usage data reveals opportunities to reduce costs:

• Cache hit rates show where responses can be reused
• Token counts identify verbose prompts that could be condensed
• Model selection patterns highlight opportunities for cheaper alternatives
• Peak usage times inform capacity planning

Chargeback capabilities

For organizations billing AI usage internally or to clients:

• Tag projects to clients for billing reconciliation
• Export usage reports for finance systems
• Track human versus agent split for different rate structures
• Allocate shared infrastructure costs fairly

9. Deploying monitoring at scale

Rolling out monitoring across an organization requires a phased approach. Start small, validate the approach, then expand with confidence.

Phase 1: Pilot deployment

Begin with a limited scope:

• A defined group of users and selected MCP servers
• Lower-risk use cases such as internal knowledge search
• Validate architecture and identify integration challenges
• Establish baseline metrics before broader rollout

Phase 2: Governance framework

Establish policies and procedures:

• Server vetting and approval workflows
• Role-based access controls aligned with organizational structure
• Monitoring and alerting for security events
• Documentation of operational procedures

Create a governance council including security, legal, and business stakeholders to approve new MCP server deployments.

Phase 3: Enterprise rollout

Expand based on pilot success:

• Additional teams and use cases
• Integration with enterprise identity providers for SSO
• Connection to production data sources
• Self-service access for developers with centralized governance

MDM deployment options

For organizations requiring enforced deployment across devices:

• Intune deployment for Microsoft environments
• Kandji deployment for Apple devices
• JumpCloud deployment for cross-platform management

Get complete visibility into Claude Code with MintMCP

Enterprises deploying Claude Code, Cursor, and other AI coding agents need visibility and governance before an incident forces action. MintMCP Agent Monitor provides real-time visibility into supported file access, commands, MCP tool calls, prompts, usage, and costs across supported coding-agent environments.

The platform extends beyond monitoring to provide comprehensive governance capabilities:

• Agent identities for autonomous workloads with dedicated credentials and permissions
• Runtime guardrails to detect and block risky actions including prompt injection, secrets exposure, and PII leakage
• Audit trails including tamper-evident access-grant history for compliance reviews
• Virtual MCPs that centralize tool access behind governed endpoints with SSO and RBAC
• SIEM integration via OTLP or Splunk HEC for security operations workflows

Organizations gain the visibility they need without slowing down developers. Start with a pilot deployment, validate the approach with security teams, and roll out enterprise-wide with confidence. Visit mintmcp.com to see how Agent Monitor works with existing AI coding tools.

Frequently asked questions

How does agent monitoring differ from traditional application performance monitoring tools?

Traditional APM tools track HTTP requests, database queries, and application metrics. They do not understand the AI agent workflow: which MCP tools the agent called, what data it accessed through those tools, which credentials it used, and whether it followed security policies. Agent-specific monitoring captures activity at the agent layer including prompts, file reads, bash commands, and MCP tool invocations, providing visibility designed for AI coding agents rather than general application telemetry.

Can monitoring help govern custom AI agents in addition to commercial ones?

Yes. MintMCP's Agent Gateway can treat autonomous agents as first-class non-human principals. Custom agents can receive their own identities with bearer keys, M2M tokens, or workload identity federation and connect through scoped Virtual MCPs that define which tools they can access. Agent Monitor can then provide visibility into supported activity from those agents.

What role do Virtual MCPs play in securing AI coding agent access to enterprise systems?

A Virtual MCP bundles approved connectors and a curated tool surface behind one governed endpoint. Instead of each developer configuring each MCP server locally with scattered credentials, users connect once to a VMCP that handles authentication, authorization, and audit. Tool curation ensures agents only see the tools they need, reducing attack surface and context-window bloat. Different VMCPs can expose read-only versus read-write tools over the same underlying connector.

How does MintMCP support auditability and compliance reviews for AI agent activities?

MintMCP logs tool calls, credential usage events, and access policy changes with full context: who initiated it, which tools were called, what data flowed through, and when. Audit and observability controls include tamper-evident access-grant history signed at write time. Organizations can export logs to SIEM systems via OTLP or Splunk HEC. The platform is SOC 2 Type II audited and compliant with HIPAA standards, supporting compliance requirements across regulated industries.

What is company-owned memory for autonomous agents and why is it important?

Coworker Agents in MintMCP use company-owned memory designed around Git-like principles, including versioning, reviewability, and organizational control. This means the organization can inspect what the agent remembers, audit changes to that memory over time, and move or delete it as needed. Unlike opaque vendor-managed memory systems, company-owned memory lets teams review instructions, track agent state, and maintain governance over the context that shapes agent behavior. Memory can be scoped to private, team, organization, or customer contexts.