# Shadow AI

The **Shadow AI** page inventories the AI tooling in the organization that nobody provisioned centrally: the coding harnesses, assistants, and local models that [enrolled devices](/docs/ai-control-plane/org-admin/device-agent) report, and the [MCP servers](/docs/ai-control-plane/secure/shadow-mcp) discovered in agent traffic. For the tools that speak MCP, it also records the organization's decision on whether they may reach Gram's MCP gateway.

Open the page from **Security and Policy > Shadow AI** in the dashboard.

> Viewing this page and deciding access require the `org:admin` scope.

This page covers:

## Harnesses and assistants

The **Harnesses** tab lists every agentic coding tool and AI IDE that enrolled devices have reported. The **Assistants** tab lists general-purpose AI assistants and agents the same way. Both kinds of tool speak MCP to Gram, so the organization's decision on gateway access applies to them.

![The Harnesses tab listing reported coding tools with their status, users, devices, signals, and last seen](/assets/docs/ai-control-plane/secure/shadow-ai-harnesses.webp)

Each row shows the tool, its decision status (**Unreviewed**, **Allowed**, or **Blocked**), how many users and devices reported it, its signals (installed, running), and when it was last seen. Search, sorting, and **More filters** narrow the list.

![The Assistants tab listing reported assistants, including an approved tool beside unreviewed ones](/assets/docs/ai-control-plane/secure/shadow-ai-assistants.webp)

Reporting depends on device enrollment: a tool on an unenrolled machine appears nowhere. See [Device Agent](/docs/ai-control-plane/org-admin/device-agent) for how devices are enrolled and what they scan.

## Deciding gateway access

1. Open the tool's row. The Decide access sheet opens; the decision applies to every MCP server in the organization.
2. Choose the decision:
   - **Approved**: the tool may reach the organization's MCP gateway
   - **Blocked**: the tool is refused when it authenticates, on every MCP server in the organization
   - **Unreviewed**: clear the decision; nothing is enforced
3. Write the rationale and select **Save decision**.

![The Decide access sheet for an approved assistant, with the Approved, Blocked, and Unreviewed options and a recorded rationale](/assets/docs/ai-control-plane/secure/shadow-ai-decide.webp)

> A decision can only be enforced for a tool that publishes a client ID metadata document, which is how the gateway recognizes it when it authenticates. For a tool without one, the sheet says no decision can be recorded and the tool stays unreviewed; adding a document to the tool's scan target makes a decision possible.

![The Decide access sheet for a tool without a client ID metadata document, explaining that no decision can be recorded](/assets/docs/ai-control-plane/secure/shadow-ai-cimd.webp)

## Local models

The **Local Models** tab lists open models that enrolled devices run locally, such as Ollama or LM Studio. These never speak MCP to Gram, so there is nothing for the gateway to allow or block: the tab is inventory, with the same columns as the other tabs, and its rows stay **Unreviewed** with no decision sheet to open.

![The Local Models tab listing locally run models with their users, devices, signals, and last seen](/assets/docs/ai-control-plane/secure/shadow-ai-models.webp)

## MCPs

The **MCPs** tab inventories every MCP server the project knows about from agent traffic and access requests, each with an evidence-backed access review. It has its own pages: the [MCPs inventory](/docs/ai-control-plane/secure/shadow-mcp) for discovery, policy status, and browsing, and [Access Review](/docs/ai-control-plane/secure/shadow-mcp/access-review) for evidence, decisions, requests, and web research.

Tool decisions and server decisions are separate levers: a harness decision governs whether a tool may reach the gateway at all, while a server decision governs whether anyone may reach a particular shadow MCP server.