Governance for shadow AI.
Your team is already using AI. Shadow Manager shows every AI tool, account, MCP server and remote session on your company's Macs, keeps secrets out of AI chats, and turns it all into ISO 27001 and ISO 42001 evidence. Self-hosted, on your own server.
Runs on your own server · Deploys with Jamf or any MDM · Prompts and pasted text are never collected
Sees the AI tools your developers actually use
- Claude Code
- Codex
- Gemini CLI
- Cursor
- GitHub Copilot
- ChatGPT
- Claude
- MCP servers
How it works
See it. Control it. Prove it.
A small agent on each Mac, a company browser extension, and a server you run yourself. No third-party cloud, and no prompts or pasted text ever collected.
Every AI tool on every Mac, in one register
AI coding CLIs, desktop apps, editor extensions, AI browsers, MCP servers and AI websites, with the supplier, who uses each one and whether it's approved.
- Claude Code, Codex, Gemini CLI, Cursor and more
- MCP servers, extensions and AI websites
- Tool updates installed only after approval
Company accounts in. Personal accounts out.
Allow, alert or block each sign-in, catch AI tools being used over SSH or remote desktop, and warn people before they paste a secret into an AI chat.
- Allow, alert or block per account
- Spots remote use over SSH, Screen Sharing and tunnels
- Rules by team, synced from Jamf departments
Audit evidence, ready when the auditor asks
Monthly PDF and CSV reports mapped to ISO 27001:2022 and ISO/IEC 42001:2023 Annex A, plus a live feed to your SIEM.
- Mapped to ISO 27001 and ISO 42001 Annex A
- Monthly PDF and CSV reports
- Splunk, Datadog, Sentinel or any webhook
Built to be trusted
A governance tool you don't have to govern.
Shadow Manager watches sensitive things, so it's built to the standard you'd expect of anything with an agent on your Macs.
23
ISO 27001 and 42001 controls evidenced
20
AI websites covered by browser controls
6
AI coding CLIs tracked and updated
0
third-party dependencies to vet
Self-hosted, start to finish
The server runs in Docker on hardware you control. Your fleet data, accounts and reports never touch a vendor cloud.
Private by design
No prompts, pasted text, page addresses or sign-in tokens are collected. For accounts, only the organisation, plan and a masked email.
Secure by default
Two-step sign-in, SSO, viewer, approver and admin roles, encrypted secrets, tamper protection on the agent, and verified updates with automatic rollback.
Fits the stack you have
Jamf inventory and departments, CSV import from other MDMs, alerts to Slack, Teams or email, and events to your SIEM.
Works with
- Jamf
- Slack
- Microsoft Teams
- Splunk
- Datadog
- Microsoft Sentinel
- OIDC SSO
- Tailscale
Pricing
Plans are on the way.
We're finalising pricing as Shadow Manager opens to other companies. Waitlist members hear first, and every plan includes the whole product.
Self-hosted
Run Shadow Manager in Docker on your own server or NAS. Your data never leaves your network.
Hosted
We run the server for you, so you only deploy the agent and the browser extension. Tell us if you'd want this.
Every plan includes
- AI register with CSV export
- AI coding CLI inventory and approved updates
- Company vs personal sign-in accounts
- Remote-use detection and policy
- Browser controls and secret-paste warnings
- Rules by team, synced from Jamf
- Staff exception requests and concern link
- ISO 27001 and ISO 42001 reports
- Slack, Teams, email and SIEM export
- SSO, two-step sign-in and roles
Be first to hear about plans and early access.
Join the waitlistFAQ
Questions, answered.
Something else on your mind? Join the waitlist and ask. You'll be talking to the developer who built it.
AI tools people use at work without IT knowing: personal ChatGPT or Claude accounts, AI coding CLIs installed on a laptop, MCP servers, AI browser extensions. Shadow Manager finds them, lets you set policy, and keeps a record you can show an auditor.
Early access
Bring shadow AI into the light.
Shadow Manager is opening to other companies soon. Join the waitlist and you'll be among the first to run it on your fleet.
- Early access as Shadow Manager opens to other companies
- A direct line to the developer who built it
- Help decide what ships next