How to Govern Shadow AI Tools: 5 Open-Source Fixes That Work

You govern shadow AI by making it visible, not by banning it. Block one tool and employees route around it with the next. The actual fix is giving IT the inventory, the runtime controls, and the sanctioned alternatives that make ungoverned AI unnecessary. Below are five open-source tools that do exactly that, mapped to the layer of the problem each one solves.

Why bans on shadow AI don't work

More than 80% of employees already use AI tools their organization hasn't approved.¹ Nearly all organizations, 98%, have employees running some kind of unsanctioned app, shadow AI included.² Only 37% of enterprises have any AI governance policy at all.¹ Just 18.5% of employees even know such a policy exists, despite 60.2% of them using AI tools at work.¹

Banning feels like the obvious fix. It isn't one. When organizations provision sanctioned AI tools that meet the same need, unauthorized use drops by roughly 89%.¹ Komprise's 2025 IT survey found nearly 80% of organizations have already had a negative AI-related data incident, and 13% say it caused measurable financial, customer, or reputational harm.³ Employees aren't running shadow AI out of malice. They're running it because the approved tools don't do what they need yet, and the underground ones do.

What does shadow AI actually cost you?

IBM's 2025 Cost of a Data Breach Report treated shadow AI as its own breach category for the first time. Organizations with high shadow AI involvement paid $670,000 more per breach on average and took a median of 247 days to even identify the incident.⁴¹² Of the organizations breached through an AI model or application, 97% lacked proper AI access controls, and 63% of breached organizations overall had no AI governance policy at all.⁴²

The shape of the risk is changing too. This isn't someone pasting a customer list into a chatbot anymore. Gartner projects the average Fortune 500 company will run more than 150,000 AI agents by 2028, up from fewer than 15 in 2025.¹ Eighty-two percent of CIOs say employees are creating AI agents and apps faster than IT can govern them.¹ Each of those agents typically talks to other tools through the Model Context Protocol (MCP), the open standard Anthropic released in late 2024 that lets an agent call external systems directly.⁵ MCP was built flexible on purpose, so authentication and role-based access control are optional rather than required, and the NSA has flagged the resulting risks, including arbitrary code execution, as high severity.⁵ In December 2025, OWASP responded with the first formal risk taxonomy for this category, the Top 10 for Agentic Applications 2026, covering goal hijacking, tool misuse, identity abuse, memory poisoning, cascading failures, and rogue agents.⁶ That taxonomy is now the reference point the newest open-source governance tools build against.

1. Cisco MCP Scanner: audit the connections your employees already built

Most teams didn't choose to run MCP. It arrived because someone wired an agent into Slack, a database, or an internal API, and MCP was the easiest way to do it. Cisco's open-source MCP Scanner, along with its companion Skill Scanner, A2A Scanner, and DefenseClaw tools, scans MCP servers, agent skills, and agent-to-agent traffic for vulnerabilities before they get connected to a production agent. That matters because MCP's security model leaves authentication and RBAC optional by design, so the same flexibility that made it popular also makes an unaudited server an easy path to arbitrary code execution.⁵ Running a scanner before you approve a new MCP connection is the equivalent of a dependency audit for a package you're about to install, except this package has permission to act on your systems. Teams already wrestling with agents that reach into internal databases will recognize the problem, the same one covered in 5 Ways to Secure Database Access for Internal AI Agents.

2. Microsoft's Agent Governance Toolkit: a policy kernel for autonomous agents

Once you know what your agents are connected to, you need a way to enforce rules on what they're allowed to do, in real time, without rewriting every agent your teams already built. Microsoft's Agent Governance Toolkit, MIT-licensed and released in April 2026, is the first open-source project to claim coverage of all 10 risk categories in the OWASP Top 10 for Agentic Applications 2026.⁷⁶ It borrows an operating-system pattern: an Agent OS acts as a stateless policy engine that intercepts every agent action before execution, at sub-millisecond latency, under 0.1ms at p99.⁷ Because it sits underneath the agent framework rather than inside it, it works across LangChain, CrewAI, AutoGen, and other stacks without requiring teams to rewrite agent code.⁷ That's the practical value: IT gets a centrally controlled policy layer, and the developers who built the agent, sanctioned or not, keep their workflow intact. This is the same scaffolding-not-model shift covered in The Rise of the AI Agent Harness.

3. Praxen: does this agent only do its job?

Runtime policy enforcement answers what an agent can do. It doesn't answer whether an agent, as built and deployed, actually does what its owner claims. Exabeam's open-source Praxen tool fills that gap with a discipline it calls Agent Behavior Verification.⁸⁹ A team writes a plain-language "Worker Remit," a markdown document declaring the agent's authorized mission, the tools it may touch, and the actions it's forbidden from taking.⁸ Praxen then reads the evidence, source code, deployment configuration, and behavioral logs, and reports the gap between what was declared and what actually happens.⁸⁹ For shadow AI specifically, this is the check that catches capability creep: an agent an employee built to summarize tickets that has quietly picked up write access to a CRM nobody remembers granting. Run it before deployment and it catches misconfiguration. Run it after and it catches drift.

4. LiteLLM: a self-hosted gateway that makes shadow usage visible

Most shadow AI isn't exotic agents. It's ordinary API calls that never touch a corporate account. 71% of generative AI connections happen through personal, non-corporate accounts, and even among connections made through corporate accounts, 58% bypass single sign-on entirely.¹ That means the CASB and SSO controls most companies rely on miss most of the traffic. LiteLLM, an MIT-licensed, self-hostable AI gateway supporting more than 100 model providers, fixes this by giving every team a single proxy to call instead of a personal API key. Issue virtual keys per team or project, set budgets, route requests, and log everything centrally, and untracked personal spend becomes a governed, observable channel. This is the same principle behind treating your AI workflow as infrastructure you run rather than a pile of vendor logins, a shift covered in more depth in Reclaiming the Dev Cycle.

5. Ollama: give employees a private workspace so data stays put

The blunt truth about shadow AI: most of it exists because employees need to think through sensitive material and the sanctioned tool is slower, worse, or nonexistent. AI is now the single largest channel for corporate-to-personal data movement, accounting for 32% of it, driven largely by employees pasting proprietary information into public tools.¹¹⁰ Running an open-weight model locally through a tool like Ollama gives employees the same drafting and reasoning help without the data leaving company-controlled hardware. It costs nothing per token, requires no outbound API call to audit, and satisfies the same productivity itch that sends people to public ChatGPT in the first place. Teams weighing which local models are actually good enough for daily work should start with The Best Local Open-Source AI and Infrastructure Tools in 2026.

How do you govern shadow AI in practice?

Frameworks like NIST's AI Risk Management Framework offer templates for building the kind of continuously maintained AI inventory that policy enforcement depends on.¹ You can't govern what you can't see, and right now most companies can't see most of what's running.

A lightweight rollout for this quarter:

1. Inventory the MCP connections you already have. Run Cisco's MCP Scanner or equivalent tooling against every server your agents currently call before approving new ones.
2. Insert a policy layer, not a rewrite. Deploy an OWASP-mapped runtime like Microsoft's Agent Governance Toolkit underneath your existing agent frameworks rather than asking teams to re-architect.
3. Verify behavior against declared intent. Use a tool like Praxen to write a Worker Remit for every agent with production access and check it before and after deployment.
4. Route API spend through a gateway. Stand up LiteLLM so personal keys stop being the default path to a model provider.
5. Give people a sanctioned private option. Deploy Ollama or similar for the drafting and reasoning work that would otherwise go to a public tool.

Some teams find it easier to run all five layers under one roof rather than stitching them together piecemeal. That's the gap a platform like Remy is built to close: a single inventory and audit trail across the agents, MCP servers, and gateway traffic a company already has, instead of five separate dashboards. Whichever combination you pick, the sequence matters more than the tooling. See what's running, put a policy layer under it, verify it does what it claims, and give people a sanctioned place to do the work they were already going to do anyway. That's what turns shadow AI from a $670,000 liability into an inventoried, boring, auditable part of the stack.