Dev Machine Guard

Dev Machine Guard is StepSecurity's endpoint product for developer laptops. It keeps a live inventory of everything on those machines that can run code, checks each item against StepSecurity threat intelligence, and lets security teams set policy on what is allowed to run. The premise is that developer machines hold GitHub tokens, npm publish rights, SSH keys and cloud credentials, and now also run AI coding agents and MCP servers that install and execute code on their own. It is aimed at security and platform teams responsible for engineering fleets. The inventory covers AI coding agents and local AI runtimes such as Claude Code, Codex, Cursor and Ollama with vendor and device counts; every configured MCP server and the tools that registered it; extensions across VS Code, Cursor, JetBrains and Windsurf, including the Open VSX marketplace, each with a risk score; npm and Python packages on disk, checked continuously; and suspicious files that execute outside package lifecycles, using detection rules StepSecurity maintains. Every finding is tied to a device identifier, and device policy is enforced through the organisation's MDM. The agent is open source, so teams can read the code that runs on their fleet. StepSecurity publishes its prices. A Dev Machine Guard licence costs $8 per device per month and includes Secure Registry, for staff who use development tools but do not contribute code. The Enterprise platform costs $16 per contributing developer per month and bundles Dev Machine Guard with CI/CD security, code repository security and priority support. Both paid options offer a 14 day free trial, and a free Community plan covers public repositories.