Daily Defender News
Aboutmerill.net
Microsoft Defender for Endpoint
Endpoint protection

Microsoft Defender for Endpoint AI agent support matrix - Microsoft Defender for Endpoint | Microsoft Learn

9 October 2026Doc update+232 / −0 lines

In brief

A new Learn article documents supported local AI agents, MCP server discovery, and runtime protection scenarios, with support listed separately by operating system and configuration. It also explains that discovery depends on observed agent activity.

What Defender admins need to know

Administrators can use the matrix to verify documented agent and MCP support and interpret local AI agent inventory results.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

new file mode 100644

layout: Conceptual title: Microsoft Defender for Endpoint AI agent support matrix - Microsoft Defender for Endpoint | Microsoft Learn canonicalUrl: https://learn.microsoft.com/en-us/defender-endpoint/ai-agent-support-matrix breadcrumb_path: /defender-endpoint/breadcrumb/toc.json feedback_system: Standard permissioned-type: public feedback_product_url: https://techcommunity.microsoft.com/t5/security-compliance-and-identity/ct-p/MicrosoftSecurityandCompliance uhfHeaderId: MSDocsHeader-MicrosoftDefender manager: bagol description: Learn which local AI agents, MCP server configurations, and runtime protection methods Microsoft Defender for Endpoint supports. author: j0shbregman ms.author: joshbregman ms.service: defender-endpoint ms.topic: concept-article ms.custom: msecd-doc-authoring-1030 ms.date: 2026-10-07T00:00:00.0000000Z ai-usage: ai-generated locale: en-us document_id: abe9e026-5716-699f-a004-f1f31a28907b document_version_independent_id: abe9e026-5716-699f-a004-f1f31a28907b original_content_git_url: https://github.com/MicrosoftDocs/defender-docs-pr/blob/live/defender-endpoint/ai-agent-support-matrix.md site_name: Docs depot_name: Learn.defender-endpoint page_type: conceptual toc_rel: toc.json feedback_help_link_type: '' feedback_help_link_url: '' asset_id: ai-agent-support-matrix moniker_range_name: monikers: [] item_type: Content source_path: defender-endpoint/ai-agent-support-matrix.md cmProducts:

Microsoft Defender for Endpoint AI agent support matrix - Microsoft Defender for Endpoint | Microsoft Learn

The Microsoft Defender for Endpoint AI agent support matrix identifies the local AI agents and related scenarios that Defender supports for discovery and runtime protection. Discovery support and runtime protection support are listed separately because they have different operating system and integration requirements.

Only supported combinations appear in the matrix. If a combination isn't listed, it isn't currently documented as supported.

AI agent discovery support

AI agent discovery identifies local AI agents and their configured Model Context Protocol (MCP) servers on onboarded devices. The Name values in these tables correspond to the Name column in the AgentsInfo advanced hunting table. The Vendor values correspond to RawAgentInfo.localAgentMetadata.vendor.

Discovery is activity based. Defender lists an agent after it observes agent activity on an onboarded device. Installing an agent doesn't by itself guarantee that the agent appears in the local AI agent inventory. For more information about how Defender observes agent activity and how this inventory differs from an inventory of installed software, see Local AI agent discovery with Microsoft Defender for Endpoint.

A checkmark in the Discovers MCP column indicates that Defender reports remote MCP server data in McpServers and local MCP server data in RawAgentInfo.localAgentMetadata.localMcps. A dash indicates that MCP server configuration discovery isn't documented for that combination.

A checkmark in the Discovers agent column indicates that Defender supports discovery of that local AI agent.

Use the values in the Name and Vendor columns in your advanced hunting queries. For examples, see Get an inventory of local AI agents and Review the MCP servers and tools that local AI agents use.

Note

For runtime protection support, see AI agent runtime protection support.

Windows

NameVendorDiscovers agentDiscovers MCP
Amp CLIAmp✓-
Antigravity CLIGoogle✓✓
Antigravity DesktopGoogle✓✓
Antigravity IDEGoogle✓✓
BuzzBlock✓-
ChatGPT ClassicOpenAI✓-
ChatGPT DesktopOpenAI✓✓
Claude CodeAnthropic✓✓
Claude DesktopAnthropic✓✓
ClawpilotMicrosoft✓-
Cline CLICline✓-
CoCo CLISnowflake✓-
CoCo DesktopSnowflake✓-
Codex CLIOpenAI✓✓
Codex DesktopOpenAI✓✓
CursorAnysphere✓✓
DeepSeek HarnessDeepSeek✓-
Devin CLICognition✓-
Devin DesktopCognition✓✓
Foundry LocalMicrosoft✓-
Gemini CLIGoogle✓✓
GitHub Copilot AppGitHub✓✓
GitHub Copilot CLIGitHub✓✓
Goose CLIAgentic AI Foundation✓-
Goose DesktopAgentic AI Foundation✓-
Grok BotSpaceXAI✓-
Grok BuildSpaceXAI✓-
Hermes AgentNous Research✓-
Junie CLIJetBrains✓✓
Kilo CLIKilo Code✓-
Kimi Code CLIMoonshot AI✓-
Kiro CLIAmazon✓✓
Kiro IDEAmazon✓✓
LM StudioElement Labs✓-
LM Studio BionicElement Labs✓-
Microsoft ScoutMicrosoft✓-
NanobotClaw✓-
Oh My PiStencil✓-
Ollama DesktopOllama✓-
OpenClawOpenClaw Foundation✓✓
OpenCodeAnomaly✓✓
Perplexity DesktopPerplexity✓-
Pi CoderEarendil Works✓-
Poe DesktopQuora✓-
QClawTencent✓-
Qwen CodeAlibaba Cloud✓-
Qwen Code Desktop-✓-
Qwen StudioAlibaba Cloud✓-
Trae IDEByteDance✓-
VSCode Claude Code ExtensionAnthropic✓✓
VSCode Cline ExtensionCline✓✓
VSCode Codex ExtensionOpenAI✓✓
VSCode Gemini Code Assist ExtensionGoogle✓✓
VSCode GitHub Copilot ExtensionGitHub✓✓
VSCode Kimi Code ExtensionMoonshot AI✓-
VSCode Roo Code ExtensionRoo Code✓✓
WarpWarp✓✓
WindsurfCognition✓✓
ZCodeZ.ai✓-
ZeroClawClaw✓✓

Windows Subsystem for Linux (preview)

The following local AI agents are supported when they run in Windows Subsystem for Linux (WSL). WSL support doesn't indicate support for native Linux endpoints.

NameVendorDiscovers agentDiscovers MCP
Claude CodeAnthropic✓-
Codex CLIOpenAI✓-
GitHub Copilot CLIGitHub✓-

macOS (preview)

NameVendorDiscovers agentDiscovers MCP
Antigravity CLIGoogle✓-
Antigravity DesktopGoogle✓-
Antigravity IDEGoogle✓-
ChatGPT ClassicOpenAI✓-
ChatGPT DesktopOpenAI✓✓
Claude CodeAnthropic✓✓
Claude DesktopAnthropic✓✓
ClawpilotMicrosoft✓-
Cline CLICline✓-
CoCo DesktopSnowflake✓-
Codex CLIOpenAI✓✓
Codex DesktopOpenAI✓✓
CursorAnysphere✓✓
Devin CLICognition✓✓
Devin DesktopCognition✓-
Foundry LocalMicrosoft✓-
Gemini CLIGoogle✓✓
GitHub Copilot AppGitHub✓✓
GitHub Copilot CLIGitHub✓✓
Goose CLIAgentic AI Foundation✓-
Goose DesktopAgentic AI Foundation✓-
Grok BuildSpaceXAI✓-
Hermes AgentNous Research✓-
Junie CLIJetBrains✓-
Kimi Code CLIMoonshot AI✓-
Kiro CLIAmazon✓-
Kiro IDEAmazon✓-
LM StudioElement Labs✓-
LM Studio BionicElement Labs✓-
Microsoft ScoutMicrosoft✓-
NanobotClaw✓-
Ollama DesktopOllama✓✓
OpenClawOpenClaw Foundation✓✓
OpenCodeAnomaly✓✓
Perplexity DesktopPerplexity✓-
Pi CoderEarendil Works✓-
Poe DesktopQuora✓-
QClawTencent✓-
Qwen CodeAlibaba Cloud✓-
Qwen StudioAlibaba Cloud✓-
Trae IDEByteDance✓-
VSCode Claude Code ExtensionAnthropic✓✓
VSCode Cline ExtensionCline✓✓
VSCode Codex ExtensionOpenAI✓✓
VSCode Gemini Code Assist ExtensionGoogle✓✓
VSCode GitHub Copilot ExtensionGitHub✓✓
VSCode Kimi Code ExtensionMoonshot AI✓-
VSCode Roo Code ExtensionRoo Code✓-
WarpWarp✓✓
WindsurfCognition✓-
ZeroClawClaw✓-

AI agent runtime protection support

Support is organized by the method Defender uses to inspect agent activity.

Runtime protection support doesn't indicate that protection is enabled on a device. To configure audit or block mode, see Set up AI agent runtime protection with Microsoft Defender for Endpoint.

A dash indicates that a mode or minimum version doesn't apply or isn't specified.

Windows (preview)

The following tables list agent and inspection method combinations on Windows.

Agent-native event inspection

Agent-native event inspection uses vendor-supported event interfaces. The hooks documentation links describe the applicable vendor interface.

AI agent or applicationModeMinimum versionsHooks documentation
Claude Code--Claude Code hooks
GitHub Copilot CLI--GitHub Copilot CLI hooks
GitHub Copilot app--GitHub Copilot hooks reference
Claude DesktopCode-Claude Code hooks
VS Code GitHub Copilot extension--GitHub Copilot hooks reference
VS Code Claude Code extension--Claude Code hooks

Network inspection

Network inspection covers agents that communicate with LLMs through well-known inference services. It doesn't cover agents that use certificate pinning or HTTP/3.

AI agent or applicationModeMinimum versions
OpenClaw--
Ollama Desktop--
ChatGPT Classic--
ChatGPT DesktopChatChatGPT Desktop 26.810.52044 (minimum tested)
\ No newline at end of file