What may an agent do without asking?
Bypass modes, approvals switched off, and grants like Bash(*) that let a line hidden in a web page act on the computer with nobody in between.
Three questions, answered on every computer
Your security team keeps asking them. NeuroCuore answers them the same way on every machine, and shows its work.
Where do keys lie open to them?
Tokens in an MCP server's settings, .env files an agent reads, a way into ~/.ssh. The report names the place. The key never leaves the computer.
Is your policy really in force?
The vendors' own policies, read on the computer itself: Claude Code's managed settings, Claude Desktop's, Codex's requirements. In force, not in force, or missing.
For each person
Their agents, on their own computer
One card per agent: what it may do, what your policy asks of it, and the date to fix it by. People fix things themselves, in plain words, or ask you for an exception when they need one.
For you
Your people, worst first
Every Critical is red, and a finding past its date says so. A computer that could not be judged tells you why: part of it not read, no recent report, or none yet.
Every finding
A file and a line you can check
Each finding carries its rule, the file and the line, so anyone can open it and see for themselves. Same rules on every Mac and PC, same answer every time.
End to end
We keep your reports. We can't read them.
Each computer seals its report to your company's key before it leaves. Your browser opens it with your passphrase, which never reaches us. Your policy is signed with your company's key, so we can't change what it asks.
Alerts go from the computers straight to your Slack, Teams or webhook. Not through us.
What our service keeps
- device
- d-7f3a2c91
- time
- Nov 3, 09:41
- app
- 3.1.0 · rules #52
- report
- sealed · 6.1 KB
What only your company sees
Names, agents, every finding with its file and line, your policy, and who asked for an exception.
“Cut people off AI and they move to their personal accounts. So NeuroCuore never blocks anyone. It shows, explains, and gets out of the way.”
Not only for developers: a seat is a person, and sales on Claude Desktop count the same as engineers on Claude Code.
Up and running in an afternoon
- 1
Sign in with your work address
Your company's domain comes from it. Nothing to put in DNS.
- 2
Invite your people
NeuroCuore mails each one an invite from your company, or they type their work address in the app.
- 3
Read the reports
Computers check in the background and report, sealed. You see who is past their date.
Free for a small team
Larger teams pay per person, monthly or yearly.
Startup
Free for up to 5 people
- Invites mailed for you
- People worst first, with dates to fix by
- A company policy, signed with your key
- Requests for exceptions
- Alerts to Slack, Teams or a webhook
Business
With your MDM
- Everything in Startup
- Macs and PCs join through Jamf or Intune, no invite needed
- Names from your MDM's sign-in names
- Events to Splunk or your SIEM
- A rules pack your company pins
Questions people ask
Can NeuroCuore read our reports?
No. Each computer seals its report to your company's key before it leaves. Our service keeps the sealed copy, the computer's id, the time and the versions, and nothing it could open. Your browser opens the reports with your passphrase, which never reaches us.
Does it block anything?
Never: not a person, not an agent, not a setting. It shows, explains and reports. If your company wants to enforce something, it does so with the vendor's own policy and its own tools, and NeuroCuore checks that the policy is in force.
Do key values ever leave the computer?
No. A report says where a key lies open, such as an MCP server's settings or a .env file an agent reads, and never the key itself.
Which agents does it read?
Claude Code, Claude Desktop, Cursor, Codex, GitHub Copilot and VS Code. When it finds an agent it can't read yet, it says so instead of staying quiet.
Do our people need an account?
No. They join from the invite NeuroCuore mails them, or by typing their work address in the app. With an MDM, computers join on their own.
Do we have to change our DNS?
No. Your company's domain comes from the work address you sign in with, and one domain belongs to one company.
Mac or Windows?
Both. NeuroCuore runs on macOS and Windows, with the same rules and the same report.
What does it cost?
It is free for up to 5 people. Larger teams pay per person, monthly or yearly.
Start with your own computer
Create your company, invite yourself, and see your own agents first.
Create your company