AI agents and MCP inventory

The AI agents and MCP inventory gives security teams visibility into the AI tooling actually running on developer endpoints: which AI agents are installed (Claude Code, Cursor, Codex, and others), which MCP servers they are configured to use, and what data and tools those servers can access.

This matters because AI tooling spreads faster than any approval process. Developers add AI agents and MCP servers on their own machines, each one a new path for credentials to move. GitGuardian found 24,008 unique secrets in public MCP configuration files in 2025 (State of Secrets Sprawl 2026). You cannot investigate what you cannot see.

Use cases

• Shadow AI discovery: detect AI agents and MCP servers that were never approved. The inventory shows what is installed across the fleet, including personal subscriptions, and not just what developers declared.
• Incident scoping: after a compromise, investigate what AI tooling was on the machine, which MCP servers were configured, and what they could reach.
• Grounding your AI usage policy: write policy from observed behavior rather than assumptions. The AI Agents inventory tells you which tools your organization actually uses before you decide what to allow.

How it works

ggshield ai discover inventories AI tooling locally on the endpoint by parsing the configuration files of supported AI agents. Like machine scans, it runs on a schedule rather than as a continuous agent, but it is its own job and is scheduled separately from the scan.

The inventory also reports whether AI Hooks are installed for each AI agent it finds, which gives you fleet-wide hook coverage without inspecting individual machines.

Add --history to also backfill MCP tool calls rebuilt from agent transcripts, with the tool input and the working directory each call ran in. This covers the period before the hooks were installed, which is usually the period an investigation cares about. See the ggshield ai discover reference for the full option list.

Deploy the inventory

Deploy the inventory as a scheduled MDM job, alongside the rest of Endpoint Protection. After the developer logs in, ggshield ai discover uses their token. Uploading needs the ai-discover:send scope, included in the default login and available on Business and Enterprise plans. For the job pattern, follow Step 7 of the service account token guide.

What is collected, and what is not

• Collected: configuration metadata about installed AI agents and configured MCP servers, whether AI Hooks are installed for each AI agent, and the AI agent's subscription email, which is what tells a company subscription from a personal one.
• Not collected: your files. Parsing happens on the endpoint, and configuration files and transcripts stay there. Any secret detected along the way is reported as a hashed fingerprint, never as a plaintext value.

The one exception is the experimental --activity flag, which ships raw agent activity records to GitGuardian, where the content is scanned and secrets are stripped before storage. Leave it off if you want parsing to stay entirely local.

For everything that leaves an endpoint across the AI layer, including what AI Hooks report at runtime, see what the AI layer sends.

Scope of the inventory

The inventory observes and reports. It does not block AI agents or MCP servers, does not change any configuration on the endpoint, and takes no action on what it detects. Use it to see and investigate. Prevention on the endpoint comes from AI Hooks, which block secrets in AI tool interactions.