AI Usage
The AI Usage page answers a question the endpoint inventory alone cannot: what are the AI tools on your endpoints actually talking to? It has three views.
API connections
Outbound connections from detected AI processes to AI provider APIs, with the process, the destination domain, and when it was last observed.
This is the data the unauthorized_api policy evaluates, see
Policy Configuration, and the data a
Firewall rule acts on.
MCP servers
Every MCP server configured for a detected AI client — name, command, arguments, transport, and the tools it exposes.
MCP servers are read from the configuration files on disk, so they are reported whether or not the client is currently running. Your MCP inventory stays complete even when nobody is using Claude Code or Cursor at the moment.
Risk scoring
Each MCP server is scored automatically and shown with a risk level plus the reasons behind it. The score reflects what the server can reach, not who published it:
| Level | Triggered by |
|---|---|
| Critical | Code-execution command (bash, python, node, sh); access to credential or system paths (.ssh, .aws, .kube, /etc) |
| High | Filesystem access outside the home directory; tools that execute code or destroy data (exec, shell, write_file, delete) |
| Medium | Network transport (HTTP, SSE, WebSocket) |
| Low | Nothing of the above matched |
Use it to triage which servers deserve a policy, not as a verdict.
Web AI
Browser-based AI usage: when someone uses a web AI service instead of a local tool. The agent matches outbound browser connections against a built-in list of known web AI domains and reports the user, browser, service, domain, and when it was last seen.
- Browsers detected: Chrome / Chromium, Firefox, Edge, Safari, Brave, Arc, Opera
- Services covered include: Claude.ai, ChatGPT, Google Gemini, Microsoft Copilot, Perplexity, xAI Grok, Poe, Character.AI, plus content-generation tools such as Midjourney, Sora, Runway, HeyGen and Jasper
No browser traffic is proxied, decrypted or inspected. Only the destination domain is matched, so Sielum can tell you that someone's browser talked to a web AI service, never what was said. To block a web AI service, add its domain as a Firewall rule — which applies to the whole device.
Availability
AI Usage is visible on every plan, including Free. Acting on what you find there — policies, firewall rules, alerts — requires the Starter plan or above, see Plans & Feature Access.