Netskope Client now detects the communication between AI agents and locally running LLMs or MCP servers by inspecting HTTP traffic on the local loopback interface (127.0.0.1/::1). This helps the security teams to get more visibility into the local AI-to-LLM traffic that is mostly missed by the traditional security tools. In other words, inspecting the loopback interface can expose the data security risks involved in the security codes, credentials, and other sensitive data.
After Netskope Client identifies the AI agent traffic on the loopback interface, the inspecting report is sent to the AI Command Center (AICC) dashboard. This provides an additional insight for the administrators along with the AI assets and network telemetry AI discovery reports. Also, refer to Exploring the Connection Graph to get a detailed view of the findings associated with the asset and the related assets.
To verify if the loopback interface AI traffic is being monitored, go to SkopeIT and check for the loopback events appearing on the webUI.
Supported Operating System and Platforms
-
Supported OS: Windows, macOS
-
Supported Client versions: 142.0.0(Windows), 143 (macOS)
Prerequisite
An active AI Command Center license.
Limitations
-
Loopback traffic interception runs at the kernel driver level and may add a small amount of latency to local loopback connections.
-
Inspection runs reliably for nearly all connections, but if an inspection cannot complete, the connection is safely allowed through to ensure uninterrupted access.
-
This feature covers traffic between an AI agent and a local MCP server or local LLM over the loopback interface only. Traffic between a local MCP server and an on-premises or cloud-hosted LLM is steered and inspected separately, through Netskope Client and Netskope Proxy.