Decawork sells IT a kill switch for shadow agents

Decawork reached #2 on Product Hunt on August 24 with 141 votes, part of the YC S26 batch. The company sells IT teams visibility into agents employees already built, plus control over the credentials those agents use to touch company systems.

Decawork finds agents employees already built in Claude Code or Cursor. It swaps the personal login each one started on for company credentials, then gives IT a place to watch and retire it.

The gap is specific. An engineer wires up an agent with their own API key. It starts touching real systems, and nobody outside that engineer's laptop knows it exists or what it can reach.

Product Hunt's similar-product listings show four other companies chasing the same job. One is Kastra, which evaluates every agent action in under 1ms. Different mechanism, same premise. The agent already runs inside the company. The product watches it and can shut it down.

The pattern underneath

None of these tools are pitching new capability. They're pitching governance for capability that already exists, unmanaged, because someone had Claude Code or Cursor open and a task to automate. The pattern matches early SaaS shadow IT, except the thing running unsupervised now takes actions instead of just holding data.

What Product Hunt's listing doesn't say is how any of these five tools discover an agent that was never registered anywhere. Detection depends on the agent showing up in a company-issued credential to begin with. The ones built entirely on someone's personal key stay invisible to the exact product meant to catch them.