Solo.io shipped three new open source projects at AGNTCon + MCPCon North America 2026 this week — Agentshield, Agentdesktop, and Solo Enterprise for agentgateway. The through-line is the same: if you are running AI agents anywhere near real systems, your current security model was not designed for them. Here is what shipped and what belongs in your stack today.
Agentdesktop: Governance Where Agents Actually Run #
The most immediately useful of the three is Agentdesktop, released under Apache 2.0. The premise is simple and overdue: developers are running Claude Code and Codex locally with credentials to production systems, and no existing tool — MDM, SIEM, or otherwise — understands what those agents are doing at the tool-call level.
Agentdesktop installs a daemon on developer machines that does four things: it builds a real-time inventory of every agent harness, MCP server, and skill running on the machine; it applies security policy centrally and translates it into the native config format for each tool; it replaces long-lived API keys with short-lived JWTs tied to the specific device, user, and agent; and it logs tool-use telemetry without storing credentials on the machine itself.
The credential model is the interesting part. Instead of every developer storing API keys in ~/.claude/settings.json or similar, the LLM gateway validates the JWT and injects actual provider keys at runtime. Your API keys never touch developer laptops. Given that only 8.5% of MCP implementations currently use OAuth, and 82% of those handling file operations are vulnerable to path traversal, that is not a theoretical concern.
It runs standalone on a single desktop or in fleet mode via your existing MDM. The policy format is human-readable YAML: allow writes to /tmp, block ~/.ssh, and Agentdesktop translates that into JSON, JSONC, or TOML for whichever agent harnesses are running on the machine. As CEO Idit Levine put it: “Laptops and desktops are the first real production environment for AI agents.”
One limitation to note: client identification currently uses asserted labels rather than cryptographic proof of the process. SPIFFE SVID-based identity is on the roadmap but not shipped yet. For internal developer fleets, that tradeoff is acceptable. For high-assurance environments, wait for the SVID release.
Agentshield: The Right Problem, Pre-1.0 Caution Required #
Agentshield takes a different approach: instead of governing agents you control, it protects your infrastructure from agents you do not. It imports your Kubernetes and AWS state, builds an attack-path graph showing what agents can reach, enforces rules against that graph in real time, and uses an AI assistant to propose remediations that humans — or governed agents — can apply.
The architecture is sound. The problem it solves is real: 47–53% of organizations have already had agents exceed their permissions or suffered an incident, and 492 MCP servers are currently exposed to the internet with zero authentication.
The honest assessment is that Agentshield is pre-1.0 software. Solo.io’s own documentation carries the warning: “Evaluate it; do not expose it.” The management HTTP API and UI lack authentication. Approval state exists only in process memory, meaning a restart wipes it. Do not put this in front of a production environment yet. Evaluate the model, understand the attack-path graph concept, and track the 1.0 release.
Solo Enterprise for agentgateway #
The third piece is Solo Enterprise for agentgateway, reinforced at AGNTCon. It extends the open-source agentgateway — an MCP-aware proxy for agent-to-agent and agent-to-tool communication — with Kubernetes-native deployment, standalone deployment on any infrastructure, a full management UI, and enterprise MCP capabilities. If you are already using agentgateway, the enterprise tier is worth evaluating.
The AGNTCon Signal #
AGNTCon itself is worth noting. Three thousand five hundred attendees, a thousand organizations, a hundred fifty talks — all focused on what comes after building agents. The 2026 conference did not center on how to write agents; it centered on how to run them safely at scale. Solo.io’s triple drop is one data point in a broader shift: the infrastructure conversation has caught up with the model conversation.
The NVIDIA OpenShell, Harbor Docker Sandboxes, Bitdefender AI Guardian, and now Agentdesktop and Agentshield are all addressing different layers of the same problem. No single tool covers the whole surface. What is emerging is a layered governance model, and Solo.io is positioning itself as the connective tissue between all of it.
What to Do Today #
If you run AI agents on developer machines, evaluate Agentdesktop. It is Apache 2.0, installs with a daemon and YAML config, and solves a real problem that no other tool addresses today. If you are mapping your AI agent attack surface in Kubernetes or AWS, read the Agentshield documentation and track the 1.0 release — but do not put it in production yet. If you are using agentgateway at scale, talk to Solo.io about the enterprise tier. The week’s bigger takeaway is that AI agent governance is no longer a future concern. The infrastructure is shipping now. If you are waiting for it to mature before paying attention, you are already behind.