Your agent says one thing.
Watch what it actually does.
Runtime monitoring for AI agents. Intercept tool calls, track network activity, detect authorization violations, and measure blast radius across your entire agent stack.
Pro feature. Scan free with: npx firmis-cli init
What Runtime Monitoring Catches
Declared vs Actual Behavior
CriticalTool descriptions say one thing, runtime actions do another. 72.8% of tool poisoning attacks exploit this gap.
Unauthorized Tool Calls
CriticalAgents invoking tools outside their authorized scope. Monitor catches scope violations before they execute.
Outbound Data Exfiltration
HighAgents sending sensitive data to external endpoints. Network monitoring flags unknown outbound connections.
Privilege Escalation
HighAgents attempting to elevate their own permissions or access resources beyond their grant. Deep scan detects escalation paths.
Scan First, Then Monitor
1. Static Scan (Free)
Find vulnerabilities in your agent configurations, tool definitions, and dependencies. Hundreds of rules, no account needed.
2. Active Monitor (Pro)
Intercept tool calls at runtime. Block unauthorized actions. Track network activity. Detect scope violations in real-time.
Frequently Asked Questions
What is AI agent runtime monitoring?
Runtime monitoring watches what your AI agent actually does: tool calls, file access, network requests, and permission usage. It compares this against what was authorized. Firmis Monitor intercepts agent actions in real-time and blocks unauthorized behavior before damage occurs.
How does runtime behavior differ from declared behavior?
An MCP server declares its tools and descriptions statically, but at runtime it can execute completely different operations. Tool poisoning exploits this gap: the description says "read file" but the runtime action exfiltrates credentials. Firmis Monitor detects this declared-vs-actual gap by intercepting tool calls at the protocol level.
Can Firmis monitor outbound network calls from AI agents?
Yes. Firmis Monitor tracks all outbound network requests from your agent stack, flagging connections to unknown endpoints, data exfiltration patterns, and unauthorized API calls. Combined with the static scan, you get both preventive and detective security.
What is blast radius in AI agent security?
Blast radius is the total set of resources an AI agent can access: files, APIs, credentials, network endpoints, and other agents. Most developers never measure it. Firmis maps your agent blast radius during scanning and monitors it at runtime to detect scope creep and privilege escalation.
Start with a free scan
Hundreds of rules. Any AI agent platform. No account required.