Unbound
Unbound is an Agent Access Security Broker that discovers AI coding agents across your org and enforces policy on what they can run, reach, and touch.
If your developers run Cursor, Claude Code, or Copilot with shell access, Unbound answers a question your existing stack genuinely cannot: what did the agent actually do? Discovery runs in under five minutes via one CLI command, enforcement is real rather than telemetry theater, and native hooks mean no proxy and no agent reinstall. The catch is scope — it governs coding agents, not all AI usage, so it will not cover non-coding AI risk. Pricing is $20/user/mo (billed annually, no user minimum) for Pro and from $38/user/mo (billed annually) for Enterprise at 100+ developer orgs, where the API Governance Fee of 10% of LLM passthrough is a percentage line item rather than a flat fee. Compare
Verified 3d ago · liveness 74/100 · cite: rightaichoice.com/tools/unbound
- Security teams needing org-wide discovery and enforcement over AI coding agents
- CISOs in financial services, healthcare, or other regulated orgs building audit evidence
- Engineering orgs running multiple agents across many developers
- Teams with unsanctioned MCP servers wired into Slack, internal tools, or cloud APIs
- Individual developers who just want a coding assistant and have no governance mandate
- Teams that have not adopted AI coding agents yet
- Organizations with no dedicated security owner to run and tune the policy engine
We scan live Reddit threads, YouTube comments, X posts, G2 reviews and other communities — and hand you an honest verdict in under a minute.
- Honest verdict, not marketing
- Real pros & cons from real users
- Attributed quotes with receipts
3 free scans · no card needed
Skip Unbound if your main AI risk is employees using non-coding AI tools rather than developers running agents with shell and MCP access, since its scope stops at the agent layer.
Pro pools 5,000 tool use evals per user per month, and once a user exceeds that the account defaults to Audit-only mode — enforcement effectively stops until you fix the quota.
Pro at $20/user/mo (billed annually, no user minimum) sits in the same band as other per-seat developer security agents and is affordable for a mid-size engineering org that just needs discovery and policy enforcement. Enterprise starts at $38/user/mo billed annually for 100+ developer orgs and adds RBAC, SSO, SCIM, SIEM export and the 10% LLM passthrough fee. Broader AI security platforms such as Apono and Prompt Security cover more surface — including non-coding AI usage — but typically cost
In short
Unbound — Unbound is an Agent Access Security Broker that discovers AI coding agents across your org and enforces policy on what they can run, reach, and touch. Best for Security teams needing org-wide discovery and enforcement over AI coding agents, CISOs in financial services, healthcare, or other regulated orgs building audit evidence, Engineering orgs running multiple agents across many developers. Plans from $20/user/mo.
What's new in Unbound
Checked 3 days agoAcross the latest 1 update: 1 news mention.
What people actually say about Unbound — is it worth it?
We ran a structured research pass across product reviews, community discussions, and post-purchase forum threads to surface the patterns vendors won't publish themselves. Below: the recurring strengths, the hidden costs people mention most, and the cohort that consistently regrets adopting this tool.
114 mentions across 7 sources (Hacker News, YouTube, Product Hunt, Bluesky, Stack Overflow, GitHub, Lemmy) · researched Jul 6, 2026.
Average across the 7 sources that answered — each source counts once, not each post.
- +Fast recursive DNS with caching – lightning local response times.
- +Wildcard-based domain blocking for easy ad-blocking lists.
- +Runs on minimal hardware like Raspberry Pi and Alpine Linux.
- +Supports DoH and DoT for encrypted queries.
- +Integrates well with Pi-hole and pfSense for network-wide filtering.
- −DoH support requires manual compilation if libnghttp2 absent.
- −Can crash or SERVFAIL under heavy TCP recursive load.
- −Setup complexity higher than using public DNS resolvers.
- −No built-in ad-blocking; relies on external blocklist management.
- −Documentation sparse for advanced configurations.
- • Additional hardware cost if not already available
- • Time investment for setup, maintenance, and troubleshooting
Viability Score
How well maintained and how widely used is Unbound? Built from what the vendor actually publishes (docs, changelog, tutorials, integrations, pricing), whether the site is live, and how much real users discuss it. How we calculate this
Last calculated: October 2026
How we score →Key Features
- Continuous agent discovery across Cursor, Claude Code, GitHub Copilot, Cline, Codex, Windsurf and more
- MCP server enumeration and configuration mapping with connection risk alerts
- MCP action policies that block, audit, or require approval on individual tool calls
- Terminal command allow/deny policies using semantic parsing
- Policy actions of Audit, Warn, Block, or Approve on agent operations
- Native lifecycle Hooks for zero-friction coverage with no proxy or agent reinstall
- Gateway mode for full API-level request and response visibility
- GitHub Copilot CLI enforcement via postToolUse hooks (audit, warn, approve, block)
- Per-developer security posture scores benchmarked against baselines
- Autonomy banding into Ask First, Auto Edit, and Full Auto
- Continuous agent inventory with installation drift detection
- IDE plugin mapping across VS Code and JetBrains
- Approval workflows for high-risk agent operations
- Full audit log of agent actions with SIEM export (Splunk, Datadog) on Enterprise
- Prompt injection and MCP attack detection signals and defensive controls
About Unbound
Unbound is an Agent Access Security Broker (AASB) built for one job: governing what AI coding agents can see, touch, and do inside your engineering org. The entry point is discovery — a single CLI command scans your environment and inventories every AI coding agent, MCP server, and IDE plugin, with the vendor's own sample dashboard splitting users into Ask First, Auto Edit, and Full Auto autonomy bands and flagging command execution and network access as top risk factors. From there the policy engine applies Audit, Warn, Block, or Approve to terminal commands via semantic parsing, to MCP connections, and to individual MCP actions (the live policy table lists named rules like blocking data_transfer, auditing write_file *env*, and blocking Slack MCP search). Two deployment modes exist: native lifecycle Hooks for zero-friction coverage with no proxy and no agent reinstall, and Gateway for full API-level request/response visibility. Unbound extended full enforcement — audit, warn, approve, block — to GitHub Copilot CLI through postToolUse hooks in May 2026. Security teams at regulated companies are the core buyer. Where Unbound is narrower than Apono or Prompt Security, it picks the coding-agent lane and covers it end to end: discovery, posture, enforcement, compliance. Unbound is operated by Web Sentry Inc. and states SOC 2 compliance.
Behind the Verdict
Unbound's strongest asset is that it starts where most buyers actually are: not knowing what is installed. The scan enumerates agents, MCP servers and their configurations, and IDE plugins across VS Code and JetBrains, then keeps tracking installation drift. The vendor's sample data shows the shape of the problem — Cursor at 40% of installs, Roo Code 18%, Claude Code 16%, Gemini CLI 11%, Codex 9%, Kilo Code 6% — and a risk table that scores individual developers on autonomy band plus risk factors like command execution and network access. That posture layer is what turns an inventory into something a CISO can act on. Enforcement is where the product earns its keep. Policies map to terminal commands using semantic parsing and to MCP servers at both the connection and individual-action level, with four actions: Audit, Warn, Block, Approve. The public policy table shows rules like blocking data_transfer, auditing write_file *env*, and blocking Slack MCP search, plus approval workflows for high-risk operations. Two integration modes matter here: Hooks use the agent's own lifecycle hooks, so there is no proxy to deploy and no agent to reinstall, while Gateway adds full API-level request and response visibility plus prompt insights and LLM interaction analysis on Enterprise. The May 2026 addition of GitHub Copilot CLI enforcement through postToolUse hooks is a useful signal that the coverage is actively widening rather than fixed to a launch-day list. The honest weaknesses are scope and throughput cost. Unbound governs coding agents, so if your real worry is employees pasting data into chatbots, this is the wrong product — Apono and Prompt Security chase that broader surface. It also assumes your developers already run agents; with nothing deployed there is nothing to score or block. Running it well takes a security owner who will tune policies, since a Block-everything posture invites developer friction and the practical path starts in Audit mode. The quota structure deserves attention at scale: Pro pools 5,000 tool use evals per user per month and defaults to Audit-only after the limit, and Enterprise carries an API Governance Fee of 10% of LLM passthrough rather than a flat fee. On the positive side, Enterprise adds the controls regulated buyers ask for — RBAC, SSO via SAML/OIDC, SCIM, 90-day+ audit log with SIEM export to Splunk and Datadog, cloud marketplace availability, and a 4-hour P1 SLA. Pro keeps 30-day log retention and a 48-hour email SLA. There is no free tier listed in the published plans, though the vendor offers a free risk assessment scan as the entry point.
Researching Unbound? Get your full AI stack in 60 seconds.
Free, no signup — tell us your goal and get tools matched to your budget & existing stack.
Real-world workflow fit
Concrete scenarios for the personas Unbound actually fits — and what changes day-one when you adopt it.
Runs the Unbound CLI scan across the org, gets an inventory of agents, MCP servers and IDE plugins, then reviews the risk dashboard where autonomy bands and command-execution flags surface the riskiest setups first.
Outcome: Within the first session they can name every Full Auto agent with command execution risk and start a policy set that audits before it blocks.
Uses Pro to audit agent activity for a quarter, tunes rules on data_transfer and write_file *env*, then upgrades to Enterprise for SSO, RBAC, 90-day+ retention and Splunk export.
Outcome: Audit evidence for agent behaviour is exportable to the existing SIEM, satisfying the review that prompted the purchase.
Enables Unbound's postToolUse hook enforcement on Copilot CLI so the same Audit/Warn/Block/Approve rules already running on Cursor and Claude Code apply to the new agent.
Outcome: New agent coverage lands without a separate rollout project or developer workflow change.
Use Cases
- Inventory every AI coding agent and MCP server installed across your engineering org with a single CLI scan in under five minutes
- Score each developer's agent setup against security benchmarks and track risk posture drift over time
- Block or require approval for destructive terminal commands like rm -rf / and DROP TABLE statements before they execute
- Govern unsupervised MCP servers that reach into Slack, internal databases, and cloud APIs
- Export an agent action audit trail to Splunk or Datadog to build compliance evidence
- Enforce the same policy set on GitHub Copilot CLI as on Cursor and Claude Code
- Detect prompt injection and MCP attack signals inside coding agent sessions
Limitations
- Unbound is built to govern AI coding agents, so its value is oriented toward organizations that actually run tools like Claude Code, Cursor, Cline, Codex, or GitHub Copilot in the developer workflow.
- The published plans are Pro at $20/user/mo billed annually with a 48-hour email SLA and 30-day audit log retention, and Enterprise starting at $38/user/mo billed annually for 100+ developer orgs with 90-day+ audit log/SIEM export (Splunk, Datadog) and a 4-hour P1 SLA.
- Pro pools 5,000 tool use evals per user per month and defaults to Audit-only mode after limits, so enforcement can lapse unless quota is monitored.
- Enterprise also carries an API Governance Fee of 10% of LLM passthrough, a variable percentage cost that scales with LLM volume.
as of 2026-10-07
Verification history
We have re-verified Unbound 8 times since . Each pass re-reads the vendor's own pages and re-checks every listed field against that evidence; passes where nothing had changed are marked as such.
- — re-verified summary, description, our verdict, our analysis, pricing model, pricing tiers, features, integrations, who it suits, who should skip it
- — re-verified summary, description, our verdict, our analysis, pricing model, pricing tiers, features, integrations, who it suits, who should skip it
- — re-verified summary, description, our verdict, our analysis, pricing model, pricing tiers, features, integrations, who it suits, who should skip it
- — re-verified summary, description, our verdict, our analysis, pricing model, pricing tiers, features, integrations, who it suits, who should skip it
- — re-verified summary, description, our verdict, our analysis, pricing model, pricing tiers, features, integrations, who it suits, who should skip it
- — re-verified summary, description, our verdict, our analysis, pricing model, pricing tiers, features, integrations, who it suits, who should skip it
Showing the 6 most recent of 8 verification passes.
Free to cite with attribution — this page re-verifies continuously.
12-month cost
Project the real annual outlay, including the implied monthly cost when only an annual tier is published.
Vendor list price only. Add-on usage, seat overages, and contract minimums are surfaced under Hidden costs & gotchas.
Plans compared
For each published Unbound tier: who it actually fits, and what it adds vs. the previous tier. Cross-reference the cost calculator above for projected annual outlay.
Pro
$20/user/mo billed annually
Ideal for
Engineering org of roughly 20-300 developers that has agents deployed and needs discovery, posture scoring and policy enforcement without enterprise identity work.
What this tier adds
Starting paid tier: $20/user/mo billed annually with no user minimum, 5,000 pooled tool use evals per user per month, Hooks plus Gateway, the Conservative → Mad Max policy presets, and 30-day audit log retention.
Enterprise
Starting at $38/user/mo billed annually
Ideal for
Regulated org of 100+ developers that needs SSO, RBAC, SCIM, SIEM export and a 4-hour P1 SLA alongside agent enforcement.
What this tier adds
Adds over Pro: RBAC, SSO (SAML/OIDC), SCIM provisioning, custom policy authoring and approval workflows, environment segregation, engineering metrics, prompt insights, 90-day+ audit log with Splunk/Datadog export, CI/CD and custom integrations, cloud marketplace availability,
Where the pricing makes sense
The company stage and team size where Unbound's pricing actually pencils out — and where peers do it cheaper.
Pro at $20/user/mo (billed annually, no user minimum) sits in the same band as other per-seat developer security agents and is affordable for a mid-size engineering org that just needs discovery and policy enforcement. Enterprise starts at $38/user/mo billed annually for 100+ developer orgs and adds RBAC, SSO, SCIM, SIEM export and the 10% LLM passthrough fee. Broader AI security platforms such as Apono and Prompt Security cover more surface — including non-coding AI usage — but typically cost
Setup time & first value
How long it actually takes to get something useful out of Unbound — broken out by persona, not the marketing-page minute.
Security engineer: first inventory in under five minutes via one CLI command, with usable posture scoring the same day. Policy authoring takes longer — expect a day or two to move from Audit-only to Warn or Block on the rules that matter, and longer if you need approval workflows. Enterprise adds SSO, SCIM and SIEM export work, typically a few days with an identity owner involved. Rolling Hooks
Switching to or from Unbound
How to bring data in from common predecessors and how to get it back out — written for the switcher, not the buyer.
- →From manual agent inventories or spreadsheets: replace them with the CLI scan and the continuous discovery dashboard.
- →From an AI gateway-only deployment: keep the gateway and add Unbound's agent-layer policy so terminal commands and MCP actions are covered too.
- →From broad AI security platforms like Apono or Prompt Security: keep them for non-coding AI usage and move coding-agent enforcement to Unbound.
- →From no agent governance at all: start in Audit mode on Pro, review the risk dashboard for a week, then switch specific rules to Warn or Block.
- ↗To a broader AI security platform (Apono, Prompt Security): if your risk shifts to non-coding AI usage, those cover more surface but sacrifice coding-agent depth.
- ↗To a general EDR or MDM: they watch processes and devices, not terminal commands or MCP calls, so you lose the agent-layer policy records.
- ↗To an AI gateway only: you keep API-level request visibility but lose pre-execution terminal command blocking and MCP action approval.
- ↗To manual review: viable only at very small scale, and you lose the audit log export that regulated reviews depend on.
Integrations
Resources & Guides
Tutorials & Learning
YouTube returned 6 videos for “Unbound”, and we withheld 6: 6 could not be judged, because “Unbound” is a single word that other videos use for other things. We are showing none, because we could not prove any of them are about Unbound.
Official links
Tools that pair well with Unbound
Common stack mates teams adopt alongside Unbound, with the specific reason each pairing earns its keep.
Endor Labs
Agentic application security that governs coding agents and verifies reachable vulnerabilities before they ship.
Salt Security
Salt Security maps every AI agent, MCP server, and API across the agentic path so security teams can see what agents can actually reach.
Veza
Veza is an identity security platform that maps who can take what action on what data across cloud, SaaS, on-prem, and AI agents.
Featured Head-to-Head Comparisons
Unbound vs Temporal Ai
If your org needs to govern AI coding agents across Cursor, Claude Code, and GitHub Copilot, Unbound is the dedicated security broker with policy enforcement (hooks + gateway) and MCP risk scoring. If you need to build reliable, crash-surviving AI agent pipelines or multi-step workflows, Temporal's durable execution platform with automatic retries and state capture is the proven choice—trusted by OpenAI and Replit. The two tools are complementary: use Unbound to secure the agents, and Temporal to build the workflows.
Unbound vs Push Security
Choose Push Security if you're defending against browser-based attacks (AiTM, session hijacking, shadow SaaS) and need to control employee use of AI tools like ChatGPT. Choose Unbound if your primary risk is AI coding agents (Cursor, Claude Code, Copilot) and you need visibility, policy enforcement, and MCP security across your engineering org. They address different threat surfaces — Push is browser security, Unbound is coding agent governance — so purchase both if both apply.
Unbound vs Audioeye
Unbound and AudioEye serve entirely different needs: one governs AI coding agents for security and compliance, the other automates web accessibility. The choice depends on your primary pain point. If your engineering org uses multiple AI agents (Cursor, Claude Code, Copilot) and you lack visibility into their actions, Unbound is the only dedicated AASB. If you face ADA/WCAG compliance pressure or lawsuits, AudioEye provides end-to-end scanning, remediation, and legal documentation. Both target enterprises but overlap minimally. Buying both is possible if you need both agent governance and accessibility compliance.
Alternatives to Unbound
View all
Endor Labs
Agentic application security that governs coding agents and verifies reachable vulnerabilities before they ship.
Salt Security
Salt Security maps every AI agent, MCP server, and API across the agentic path so security teams can see what agents can actually reach.
Frequently Asked Questions
Best-of guides
Topics
Used Unbound? Help shape our editorial sentiment research.