Astrix secures agent identities, credentials, and access. Willow governs employee AI tools with MCP discovery, device policies, scoped access, and runtime approvals.
An employee connects an AI assistant to company tools. Security now needs to know what was installed, which resources it can reach, and whether a sensitive action needs approval. Finding the connection is the start of that decision. Governing its use is the next step.
Willow brings those decisions into an employee AI workflow. It discovers local MCP servers, skills and plugins, applies device policies, and gives employees access to approved tools. Publication checks and approval before selected tool calls give security teams control over both the capabilities they distribute and the actions those capabilities perform.
Astrix approaches agent security through identities and access. It connects agents, MCP servers, non-human identities (NHIs) and secrets with their owners and resources. Its Agent Control Plane (ACP) provisions scoped credentials for managed agents, while its security workflows address risky access and credential misuse.
The distinction matters when choosing the control a team needs. Willow centers on approving and governing employee AI capabilities. Astrix centers on the identity and credential estate behind agents. The two overlap in discovery, and can serve separate responsibilities within the same organization.
Both products discover MCP activity on employee endpoints. Willow connects those findings with device policies for the servers, skills and plugins employees use. Astrix connects endpoint MCP discovery with agent and credential context. For a security team, the practical difference is the decision that follows a finding: whether a capability is approved for use, or whether its associated identity and access pose a risk.
Turn local AI discovery into policy
Unmanaged AI use includes more than a connection to a model. An employee can install an MCP server, add a skill that changes an assistant’s behavior, or use a plugin containing instructions and commands. Willow’s Scan Agent brings those local capabilities into view, including skill and plugin contents and instruction files such as CLAUDE.md and AGENTS.md.
Willow pairs that inventory with allow, warn and block rules scoped to users, groups or devices. Security can approve a team’s tools, flag an unfamiliar capability, or block a supported unmanaged integration. Blocks are reversible, giving IT a way to respond to shadow AI without losing the original configuration. Device enforcement applies to supported capabilities on endpoints running the Scan Agent.
A shared skill or plugin can shape how an entire team uses AI. Willow’s build-time guards check tool selections, embedded prompts, skill text and command definitions before a toolkit or plugin is published. A failed check can stop distribution, putting review ahead of employee adoption.
Organizational skills can be assigned to groups, synchronized from GitHub and packaged in plugins. Toolkits bring servers, skills and commands together into a shared workflow. Employees get a practical way to use approved capabilities, while security retains control over what is distributed and which groups receive it.
Useful access does not need to give an assistant every action a server exposes. Willow supports tool-level availability and human approval before selected tools run. A team can make read operations available, keep other tools disabled, and require confirmation for a sensitive invocation. Each call to a tool marked for approval requires that confirmation.
Runtime input guards can block a gateway request before it reaches the MCP server; response guards inspect the returned result. Together with publication checks, these controls give security teams review points for the shared capability and its actual use. They support least privilege for AI agents at the tools employees can access and the calls they make.
Willow’s Guard Hooks check supported prompts and file-tool calls in Claude Code, Cursor and Codex. This brings guard decisions into the coding environment where employees work. The hooks fail open during a timeout or service outage; gateway tool approvals provide a separate review point for calls handled by Willow.
Prompt Guard applies runtime guards to prompts and attachments in supported web AI services, including ChatGPT, Claude and Gemini. It can warn, redact or block sensitive content. The Chrome and Edge extension is in beta, giving organizations a browser protection option alongside coding-client and gateway controls.
Willow groups determine which MCP servers, toolkits and skills employees can use. Self-service connections let an employee use the approved set assigned to their group. SCIM links human users and groups to the identity provider, including account deactivation during offboarding.
For automation, machine users provide dedicated credentials, group-scoped access and assigned human owners. Willow also supports background agents whose tool calls pass through its gateway policies. Machine-user gateway secrets are static until rotated, with a lifecycle managed separately from human-user offboarding.
Willow’s request logs record the user, tool, server, outcome and guard decisions for requests it handles. Filters and exports support investigation and review. Radar adds an AI posture view across identity, shadow AI, data exposure, agents and monitoring, helping security teams connect individual findings with areas that need attention.
Astrix ACP onboards agents with pre-approved permission profiles and short-lived, scoped tokens. This fits agent deployments where automatic credential expiration is a requirement. Willow’s machine users provide governed tool access through groups and rotatable gateway secrets; ACP’s distinction here is the temporary credential issued to an onboarded agent.
Credential lifetime and tool-call approval answer different questions. Expiration limits how long access remains valid. Willow’s approval step reviews a selected action before it runs. An organization can require either control, or both, for a particular agent workflow.
Astrix’s secret-management workflows cover inventory across vaults, ownership, rotation policies and unvaulted secrets. Its NHI posture analysis identifies stale, unused and overprivileged identities. These capabilities fit a security program responsible for machine identities and secrets across connected environments.
Willow stores connector secrets and governs machine-user access to its tools. Cross-vault secret inventory and rotation are a different operational requirement from deciding which employee tool or action is approved.
Astrix threat detection and response analyzes behavioral patterns to identify suspicious agent activity and supports remediation through security operations workflows. Its Threat Center groups related detections into prioritized cases. This is relevant to teams investigating compromised credentials, risky access and agent behavior across their identity estate.
As of October 17, 2026, Willow lists a $0 Free plan and Enterprise pricing per human seat, billed annually. Enterprise includes fleet discovery, runtime guardrails and SCIM. Astrix offers a sales-led evaluation, with pricing provided through its commercial process.
Willow offers SaaS, hybrid and on-premises deployment. Hybrid keeps tool execution in the customer’s Kubernetes cluster while Willow hosts the admin console, authentication and audit logs. Full on-premises deployment hosts all components in the customer’s cluster, without a Willow SaaS dependency at runtime. These options matter when tool execution or the full service must remain inside company infrastructure.
An existing Astrix deployment can address NHI discovery, credential security and agent provisioning while Willow governs employee access to MCP servers, skills and plugins. There is a case for both when the organization needs those separate controls. Overlapping discovery alone is a weaker reason to add a second platform than a specific need for device policy, publication review or tool-call approval.
For an employee AI rollout, Willow brings discovery, approval and ongoing policy into the tools people use every day. Astrix fits requirements centered on temporary agent credentials, cross-vault secrets and NHI security operations. The choice follows the control the team needs to own.
Willow governs employee AI capabilities and tool use through device policies, approved distribution and runtime controls. Astrix focuses on agent identities, credentials and NHI security operations. Both provide discovery, but the decisions they support differ.
Yes. Willow discovers local MCP configurations alongside skills, plugins and instruction files, with policies for supported unmanaged capabilities. Astrix discovers endpoint MCP activity through EDR integrations or its endpoint service and adds identity and credential context.
Willow can disable tools, apply runtime input guards and require human approval before selected tools execute. Publication guards review shared toolkit and plugin content before distribution. This gives security teams control over both the capability and its use.
Willow machine users have human owners, group-scoped access and gateway secrets that remain valid until rotated or revoked. Astrix ACP issues scoped, short-lived credentials to onboarded agents. Automatic expiration is a reason to evaluate ACP for that access path.
Yes. Hybrid deployment runs tool execution in the customer’s Kubernetes cluster, with the admin console, authentication and audit logs in Willow SaaS. Full on-premises deployment hosts every component in the customer’s cluster.
Willow fits employee workflows that need approved tools, local capability policies, shared-content review and approval before sensitive tool calls. Astrix can continue to support the organization’s NHI and credential-security program.
Give them a Basecamp. Go from AI chaos to AI work, in minutes.
