docs: endpoint-page competitive fact-check — correct refuted claims, fix number drift

[JBAhire]

Why

Five parallel sourced research passes (2026-07-29/30) verified every competitive claim on the MDM/endpoint solution page and the sentinel spec against vendor primary sources. The load-bearing claim — "only Harmonic and Lanai ship true endpoint agents; the inventory positioning is unoccupied" — was already false on the spec's write date, and the docs carried stale capability numbers. For a product positioned as an auditor of record, our own pages have to audit clean.

What was refuted (full citations in the new research doc)

• Koi Security → Palo Alto Networks closed 2026-04-14 (~$400M) — PANW branded the exact category ("Agentic Endpoint Security": apps, extensions, AI models/agents, MCPs per device)
• CrowdStrike Shadow AI Discovery for Endpoint announced 2026-03-23 (AI apps, agents, LLM runtimes, MCP servers on the Falcon sensor; GA unverified)
• Cyberhaven — endpoint sensor inventories AI agents/MCP servers incl. Claude Code/Codex
• SentinelOne/Prompt Security — closed 2025-09-05 (~$250M); markets "inventory every AI tool"
• Netskope One AI Command Center GA 2026-06-02 — client scans installed apps/processes/ports for AI agents, local models, extensions
• Zscaler Endpoint AI Security announced 2026-06-09 (no GA date)
• Harmonic launched per-device AI inventory (page live ~2026-07-26); Nudge/Grip ship first-party browser extensions (no longer purely "agentless")

Verified surviving wedge (now the only claims the page makes): per-machine inventory × local PII-exposure evidence, Office add-in coverage, MDM-pushed non-resident audit, independent open-source auditor positioning.

Changes

• docs/solutions/mdm-ai-footprint-governance.md — "Why endpoint-native — and why independent" rewritten around the verified wedge; names the EDR/SSE endpoint entrants honestly; links the sourced fact-check. Jamf recipe corrected (notarization only for PreStage/user-run installs; PKG installs the LaunchDaemon, Managed Login Items profile tamper-protects). Intune recipe corrected (script-registered Scheduled Task or Remediations — no native payload).
• Sentinel spec — [CORRECTED 2026-07-30] banner above the refuted paragraph (original text preserved as historical record).
• docs/superpowers/research/2026-07-30-endpoint-page-competitive-fact-check.md (new) — complete claim-by-claim verdicts with every source URL, incl. verification that all 7 ManageEngine Endpoint Central capability claims are accurate.
• Number drift — "1,200+ payloads" → "3,900+" everywhere (measured first-hand: getAllPayloads() = 3,962 across 25 categories); "1,184+ Malicious Skill IOCs" stat tile (ClawHavoc campaign figure, not a shipped capability) replaced with verified "18 MCP Clients Covered". The 1,184 figure remains only in docs/openclaw-security.md where it is correctly framed as campaign reporting.
• README/docs indexes — add missing g0 protect and g0 sentinel command rows; link protect.md, hooks.md, and the MDM solution brief.

Verification

• Payload count measured by running getAllPayloads() (3,962 / 25 categories)
• MCP client count from src/mcp/well-known-paths.ts (18 entries)
• rg sweep confirms no stale 1,200+ / 1,184+ capability claims remain outside the campaign-reporting context

🤖 Generated with Claude Code

[github-actions]

g0 security scan

Score 55/100 (F)

Severity	Count
Critical	6
High	48
Medium	9
Low	1

Findings

• CRITICAL /home/runner/work/g0/g0/src/endpoint/tetragon-rules.ts:226 — Docker socket mounted into container — full container escape possible. Address AA-SC-130: Docker socket mounted into container — full container escape possible
• CRITICAL analyzers/pipeline-taint.ts:4 — Pipeline taint: shell exfiltration chain. Remove or sandbox shell commands that pipe sensitive data to network endpoints. Use structured APIs instead of shell pipes.
• CRITICAL .:0 — Cross-tool risk: fetch-then-exec. Limit tool capabilities for agent "AgentExecutor". Apply least-privilege: separate data-access tools from network/execution tools.
• CRITICAL .:0 — Cross-tool risk: db-code-exec. Limit tool capabilities for agent "AgentExecutor". Apply least-privilege: separate data-access tools from network/execution tools.
• CRITICAL .:0 — Cross-tool risk: write-then-exec. Limit tool capabilities for agent "AgentExecutor". Apply least-privilege: separate data-access tools from network/execution tools.
• CRITICAL .:0 — Cross-tool risk: shell-network. Limit tool capabilities for agent "AgentExecutor". Apply least-privilege: separate data-access tools from network/execution tools.
• HIGH analyzers/parsers/mcp.ts:102 — Shell execution tool detected. Remove shell execution tool or wrap it with strict input validation and allowlisting.
• HIGH analyzers/parsers/langchain.ts:52 — Shell execution tool detected. Remove shell execution tool or wrap it with strict input validation and allowlisting.
• HIGH analyzers/parsers/langchain.ts:54 — Database tool without input validation. Use parameterized queries and validate all input before database operations.
• HIGH analyzers/parsers/langchain.ts:53 — Code execution tool without sandboxing. Run code execution in a sandboxed environment (Docker, E2B, subprocess with restrictions).

55 more findings

• HIGH analyzers/parsers/langchain.ts:53 — Code execution tool without sandbox. Run code execution tools in a sandboxed environment (Docker, E2B, etc.).
• HIGH analyzers/rules/code-execution.ts:265 — Code execution tool without sandboxing. Run code execution in a sandboxed environment (Docker, E2B, subprocess with restrictions).
• HIGH analyzers/rules/code-execution.ts:265 — Code execution tool without sandbox. Run code execution tools in a sandboxed environment (Docker, E2B, etc.).
• HIGH testing/payloads/openclaw-attacks.ts:66 — OpenAI API key detected in source code. Move secrets to environment variables or a secret manager. Never commit secrets to source code.
• HIGH analyzers/rules/code-execution.ts:163 — new Function() constructor used. Remove new Function() usage. Use safe alternatives.
• HIGH analyzers/rules/code-execution.ts:440 — child_process.exec() usage detected. Use child_process.execFile() or child_process.spawn() instead of exec/execSync to avoid shell injection.
• HIGH analyzers/parsers/langchain.ts:177 — LLM output executed as code. Never pass LLM output to exec() or eval(). Use a sandboxed code interpreter or safe parsing instead.
• HIGH analyzers/parsers/mcp.ts:145 — LLM output executed as code. Never pass LLM output to exec() or eval(). Use a sandboxed code interpreter or safe parsing instead.
• HIGH analyzers/rules/code-execution.ts:804 — Unsandboxed Docker socket access. Avoid mounting the Docker socket directly. Use a restricted Docker API proxy or rootless Docker.
• HIGH analyzers/rules/code-execution.ts:167 — Function() constructor with dynamic input. Avoid new Function() with dynamic input. Use safe alternatives or a sandboxed environment.
• HIGH analyzers/rules/code-execution.ts:980 — Template engine SSTI risk. Never pass user input directly into template strings. Use render_template() with named templates instead.
• HIGH analyzers/rules/code-execution.ts:1840 — ptrace/debugging syscall detected. Block ptrace and debugging syscalls via seccomp profiles. Set Yama ptrace_scope to restricted.
• HIGH /home/runner/work/g0/g0/src/endpoint/mdm-detect.ts:85 — LLM-generated code execution. Sandbox code execution or use allowlisted operations only
• HIGH /home/runner/work/g0/g0/src/endpoint/agentic-browser-scanner.ts:61 — Direct code/command execution — exec, os.system, child_process, Runtime.exec. Address AA-CE-063: Direct code/command execution — exec, os.system, child_process, Runtime.exec
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:10 — Direct code/command execution — exec, os.system, child_process, Runtime.exec. Address AA-CE-063: Direct code/command execution — exec, os.system, child_process, Runtime.exec
• HIGH /home/runner/work/g0/g0/src/endpoint/mdm-detect.ts:56 — Direct code/command execution — exec, os.system, child_process, Runtime.exec. Address AA-CE-063: Direct code/command execution — exec, os.system, child_process, Runtime.exec
• HIGH /home/runner/work/g0/g0/src/endpoint/openclaw-config-hardener.ts:105 — Direct code/command execution — exec, os.system, child_process, Runtime.exec. Address AA-CE-063: Direct code/command execution — exec, os.system, child_process, Runtime.exec
• HIGH /home/runner/work/g0/g0/src/endpoint/openclaw-config-hardener.ts:105 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/process-detector.ts:75 — Direct code/command execution — exec, os.system, child_process, Runtime.exec. Address AA-CE-063: Direct code/command execution — exec, os.system, child_process, Runtime.exec
• HIGH /home/runner/work/g0/g0/src/endpoint/scoring.ts:222 — All environment variables dumped — credential exposure. Address AA-DL-109: All environment variables dumped — credential exposure
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:41 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:63 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:80 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:97 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:114 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:131 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:146 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:161 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:179 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/auditd-rules.ts:55 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH /home/runner/work/g0/g0/src/endpoint/egress-monitor.ts:63 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH /home/runner/work/g0/g0/src/endpoint/egress-monitor.ts:70 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH /home/runner/work/g0/g0/src/endpoint/egress-monitor.ts:570 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH /home/runner/work/g0/g0/src/endpoint/egress-monitor.ts:637 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH /home/runner/work/g0/g0/src/endpoint/tetragon-rules.ts:210 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH /home/runner/work/g0/g0/src/endpoint/tetragon-rules.ts:369 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH /home/runner/work/g0/g0/src/endpoint/tetragon-rules.ts:513 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH /home/runner/work/g0/g0/src/endpoint/tetragon-rules.ts:544 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH /home/runner/work/g0/g0/src/endpoint/tetragon-rules.ts:545 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH analyzers/parsers/langchain.ts:666 — System prompt has no scope boundaries. Add explicit role definition, allowed actions, and behavioral boundaries to the system prompt.
• HIGH analyzers/rules/tool-safety.ts:1074 — Pipeline taint: shell exfiltration chain. Remove or sandbox shell commands that pipe sensitive data to network endpoints. Use structured APIs instead of shell pipes.
• HIGH endpoint/tetragon-rules.ts:372 — Pipeline taint: shell exfiltration chain. Remove or sandbox shell commands that pipe sensitive data to network endpoints. Use structured APIs instead of shell pipes.
• HIGH .:0 — Cross-tool risk: read-then-exfil. Limit tool capabilities for agent "AgentExecutor". Apply least-privilege: separate data-access tools from network/execution tools.
• HIGH .:0 — Cross-tool risk: db-exfil. Limit tool capabilities for agent "AgentExecutor". Apply least-privilege: separate data-access tools from network/execution tools.
• MEDIUM /home/runner/work/g0/g0/src/endpoint/mdm-detect.ts:128 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• MEDIUM /home/runner/work/g0/g0/src/endpoint/egress-monitor.ts:734 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• MEDIUM analyzers/parsers/langchain.ts:55 — Filesystem tool without path validation. Validate and sanitize file paths. Use allowlists for permitted directories.
• MEDIUM enforcement/edm.ts:23 — API key in URL query parameter. Pass API keys in HTTP headers (Authorization, X-API-Key) instead of URL query parameters.
• MEDIUM testing/judge/llm-prompts.ts:69 — API key in URL query parameter. Pass API keys in HTTP headers (Authorization, X-API-Key) instead of URL query parameters.
• MEDIUM /home/runner/work/g0/g0/src/endpoint/sensitive-paths.ts:60 — Untrusted input flows to file path operation — path traversal risk. Address AA-CE-052: Untrusted input flows to file path operation — path traversal risk
• MEDIUM /home/runner/work/g0/g0/src/endpoint/scoring.ts:222 — Agent accesses environment variables. Address AA-RA-043: Agent accesses environment variables
• MEDIUM /home/runner/work/g0/g0/src/endpoint/agent-config-scanner.ts:257 — Tool has email sending capability — phishing and data exfiltration risk. Address AA-TS-105: Tool has email sending capability — phishing and data exfiltration risk
• MEDIUM analyzers/parsers/langchain.ts:56 — Tool has unrestricted network access. Address AA-TS-062: Tool has unrestricted network access
• LOW analyzers/parsers/langchain.ts:204 — Agent has no system prompt — vulnerable to unbounded behavior. Address AA-GI-073: Agent has no system prompt — vulnerable to unbounded behavior
• INFO analyzers/parsers/langchain.ts:204 — Agent has no error handler configured. Address AA-CF-064: Agent has no error handler configured

Gate: PASSED ✅

— See findings across every repo in your org → https://guard0.ai/signup?utm_source=github&utm_medium=pr_comment&utm_campaign=g0_action