Say no
82%
of AI pastes come from personal accounts.
Banning a tool moves the use somewhere you can't manage it.
Say yes to AI, on your terms.
Teams get the AI tools they ask for, and Archetypal protects every device and browser they use them on. Archie sets it up with you.
- Can my team use Claude Code?Engineeringapproved with terms
- Is this MCP server OK to install?Platform teamneeds a look
- Can finance try Cursor for the close?Financeapproved
- Can we use ChatGPT for the launch copy?Marketingapproved with terms
Every week, someone asks whether they can use an AI tool.
A flat no and a flat yes both leave you exposed.
Say yes to everything
22%
of pastes include personal or payment data.
Without rules, you learn about a leak after it happens.
Archie, its AI agent, explains what Archetypal finds, drafts the rules and plans the cleanup, and asks before he changes anything.
How it works
What happens after you install Archetypal.
Each step builds on the one before it, from the first scan to cleanup.
01 · Discover
Find every AI tool on every device.
The sensor and the browser extension report what runs.
- Apps, coding agents and MCP servers
- AI and paste sites in the browser
SensormacOSListeningReporting
Browser extensionChromeListeningReporting
What's on this device
Claude Codecoding agent
postmark-mcpMCP server
chatgpt.comAI site
pastebin.compaste site
02 · Inspect
See which items are risky and why.
Archetypal scores every item and ranks the findings.
- Findings ranked from critical to low
- One Mission safe score that shows what to fix next
Needs you3
postmark-mcpintel.blockedcritical
1 device with no extensionneeds a look
4 rules still in dry rundry_run
Mission safe
62
03 · Enforce
Turn your policy into rules.
Rules come from your policy, and each one starts in dry run so you can see its effect first.
- Which apps and agents may run, plus reminders and blocks in the browser
- Access for one team for a week
Rulesversion 3
block-content-ai-assistantenforce
warn-paste-chatgptenforce
warn-content-paste-bindry_runenforce
block-unsigned-invaliddry_run
Blocked by your company's policyblock
This looks like a password, a key or a token. Your company's rule doesn't allow it here.04 · Prevent
Stop the next attack before it reaches a device.
Archetypal blocks a malicious item and checks that it stopped.
- Block it everywhere, remove it and tell the people affected
- Hold new package versions for a week
Contain postmarkrunningcontained
Block it everywherependingdone
Remove its code packagependingdone
Tell the peoplependingdone
Check it's stoppedpendingdone
Guardrails
guardrail-version-cooldown7 days
guardrail-install-scriptsdry_run
Meet Archie
An AI security analyst who asks before changing anything.
Archie is the AI agent built into Archetypal. He reads what Archetypal sees, tells you what matters, and drafts rules and cleanup plans for you to approve. Nothing changes until you do.
Answers questions about your devices.
Archie answers from the data Archetypal collects, in plain words. If something isn't reporting yet, he says so.
Archie
What AI is running on our devices?
Checked your devices
Read the AI tools and servers
Read the apps and web apps
Claude Code and Cursor, the postmark-mcp server, and chatgpt.com in the browser. pastebin.com is a paste site.
Explains risk in plain words.
Archie says why an item is risky and ranks what to fix first, working from the findings rather than guessing.
Archie
What should I fix first?
Read the critical findings
Opened postmark-mcp
Criticalpostmark-mcp is on the malicious list.
First, contain postmark-mcp. Then the device with no extension. Then the 4 rules still in dry run.
Drafts rules from your policy.
Give Archie your policy or answer a few questions, and he writes the rules into a draft. Nothing changes until you publish.
Archie
AI acceptable-use policy.docx
Read the document
Drafted the rules
7 rules drafted and saved to the draft.
Publish the 7 rules?
PublishKeep as draft
Asks before anything that writes or loosens protection.
Archie shows you a card, and only you can press Approve.
Archie
Let Finance use Perplexity.
Opened the request
Let Finance use Perplexity for 7 days?
ApproveDecline
Approved for Finance for 7 days. It ends on its own.
Plans containment and checks it stopped.
When an item is named malicious, Archie plans the cleanup, you approve each step and he checks that it stopped.
Archie
Maliciouspostmark-mcp is named malicious.
Planned the cleanup
Contain postmark-mcp?
- Block it
- Remove it from devices
- Tell the people who use it
ApproveDecline
Blocked, removed, people told.
Checked postmark-mcp again
postmark-mcp is stopped.
Speaks first when something needs you.
Archie keeps a short Needs you list and brings up anything new that needs a decision before you ask.
Archie
Checked what needs you
CriticalNew: postmark-mcp.
postmark-mcp needs a decision. Contain it?
postmark-mcp
Contain itSnooze for 30 days
Start from a prebuilt policy for your framework.
Choose a framework and start from its prebuilt policy. Archie tailors it to your answers and asks before he changes anything. Each line shows its rule and mode, ready to export for your auditor.
MITRE ATLAS
OWASP LLM Top 10 and Agentic Top 10
NIST AI RMF and 600-1
ISO/IEC 42001
EU AI Act
CSA AI Controls Matrix
Google SAIFMITRE ATLAS · prebuilt policyExport PDF
Supply chain compromiseNew package versions are held for 7 days before anyone installs them.dry_runguardrail-version-cooldown
Supply chain compromiseInstall scripts of new packages do not run.dry_runguardrail-install-scripts
Exfiltration through AI toolsAPI keys, secrets and tokens are never sent to an AI assistant.enforceblock-content-ai-assistant
Misuse of agent toolsAgents connect only to MCP servers we have listed.dry_runguardrail-unlisted-mcp
OWASP LLM Top 10 and Agentic Top 10 · prebuilt policyExport PDF
Sensitive data in promptsCredentials of any kind stay out of prompts.enforceblock-content-ai-assistant
Excessive agencyAn agent may use only the MCP servers we have approved.dry_runguardrail-unlisted-mcp
Supply chainInstall scripts of new packages are blocked.dry_runguardrail-install-scripts
Unapproved toolsAI tools that are not in the catalog are flagged for review.dry_runflag-uncatalogued
NIST AI RMF and 600-1 · prebuilt policyExport PDF
Map: AI in useWe know which AI tools our people use, including the ones nobody approved.dry_runflag-uncatalogued
Govern: acceptable usePeople are reminded that ChatGPT is for work use only.enforcewarn-paste-chatgpt
Manage: data in promptsCredentials and tokens are blocked before they reach an AI assistant.enforceblock-content-ai-assistant
Manage: third-party componentsNew package versions wait 7 days before we use them.dry_runguardrail-version-cooldown
ISO/IEC 42001 · prebuilt policyExport PDF
Acceptable use of AIPeople see the work-use reminder before they paste into ChatGPT.enforcewarn-paste-chatgpt
Data used with AISecrets and credentials are blocked from AI assistants.enforceblock-content-ai-assistant
AI system inventoryAI tools outside the catalog are flagged and reviewed.dry_runflag-uncatalogued
Suppliers and componentsSoftware with a missing signature does not run.dry_runblock-unsigned-missing
EU AI Act · prebuilt policyExport PDF
AI literacyPeople get a clear reminder of what they may share with ChatGPT.enforcewarn-paste-chatgpt
Data governanceCredentials never go into an AI assistant.enforceblock-content-ai-assistant
Record keepingEvery AI tool outside the catalog is flagged and logged.dry_runflag-uncatalogued
Cybersecurity of AI componentsSoftware with an invalid signature does not run.dry_runblock-unsigned-invalid
CSA AI Controls Matrix · prebuilt policyExport PDF
Supply chainNew package versions are held for 7 days.dry_runguardrail-version-cooldown
Supplier integritySoftware with an invalid signature does not run.dry_runblock-unsigned-invalid
Data securityClient source code under NDA stays out of paste sites.dry_runwarn-content-paste-bin
Agent and tool accessAgents reach only the MCP servers on our list.dry_runguardrail-unlisted-mcp
Google SAIF · prebuilt policyExport PDF
Secure the supply chainInstall scripts of new packages are blocked.dry_runguardrail-install-scripts
Protect dataAPI keys, secrets and tokens never reach an AI assistant.enforceblock-content-ai-assistant
Control agent permissionsAn agent uses only MCP servers we have listed.dry_runguardrail-unlisted-mcp
Watch what is in useAI tools that are not in the catalog are flagged.dry_runflag-uncatalogued
Mission safe
Know what to fix next.
Archetypal turns your coverage into one score out of 100. Archie ranks the gaps and tells you which to close next, and the score rises as you close them.
5462
out of 100
Archie recommendsranked by points
- +8Turn on guardrail-unlisted-mcpFixfixed
- +5Enforce warn-content-paste-binFix
- +3Hold new package versions for 7 daysFix
Each fix lands in the draft. Nothing changes until you publish.
Archie suggests the safeguard before anyone asks.
Archie watches packages, MCP servers, extensions and models for new threats. When one could reach your devices, he suggests a safeguard first, such as holding new package versions for a week.
Archieneeds you
I'm watching for new threats in the packages your devices install every day. A malicious version can spread before anyone notices, so I suggest two guardrails. Turn them on, in dry run first?
Hold new package versions for 7 days
guardrail-version-cooldowndry_run
guardrail-version-cooldowndry_run
Block install scripts of new packages
guardrail-install-scriptsdry_run
guardrail-install-scriptsdry_run
Turn them onNot now
Shai-Huludnpm worm · September 2025
It spread through install scripts and hit more than 180 packages in its first wave.
Flashpoint, Cloud Security Alliances1ngularityNx packages · August 2025
Malicious versions turned AI coding CLIs on the device into secret hunters.
CloudsmithSee it on your own policy.
See Archetypal and Archie work through your own policy. We will set up a time with your team.
Book a demoArchetypal