AI agent discovery
The Safeguard CLI and Desktop app detect the supported AI coding agents on a computer, what each may do, the skills, plugins, MCP servers and models they use, and what they did, and show it in Assets › Inventory › Asset discovery.
AI agent discovery
Early access. AI agent discovery is switched on per organisation by Safeguard. Ask your Safeguard contact to enable it; your administrator then turns it on for your organisation, and each person allows it on their own computer.
AI agent discovery runs on the computers your people work on, inside the Safeguard CLI and the Safeguard Desktop app. It detects the supported AI coding agents on the machine (the list is below; agents not on it are not detected) and reports, per device and per person:
- Agents installed and running, their versions, and what each one is allowed to do: shell commands, file edits, network access, auto-approved tools, sandbox and permission mode, extra folders it can reach.
- MCP servers each agent is connected to, with their transport, package and the tools seen in use. Environment and header values are never read: only their names.
- Skills, plugins, extensions, rules, commands and sub-agent definitions installed into each agent, with a hash of each definition so it can be scanned later (see Gold registry).
- Models: model files in the known model folders (Ollama, LM Studio, the Hugging Face cache, Jan) with format, size, parameter count and quantisation, and the models each agent was configured with or used.
- Credentials an agent refers to, by name and kind only, for example
ANTHROPIC_API_KEY (environment)orCodex login (file present). Credential values are never read or sent. - Activity, from the agents' own local session files: each session as a chain of what invoked what, from the prompt to the agent, its tool calls, the sub-agents it started and their own calls, with counts, timing, token use, the domains it fetched and the MCP tools it called.
It reads only each agent's own folders, runs as the signed-in person (never as administrator), and sends nothing until the organisation has it on and the person agrees.
Where to see it
Assets › Inventory › Asset discovery in the Safeguard app lists, with filters for device, person and agent:
| Tab | Shows |
|---|---|
| Agents | Each agent on each device, its access summary, models, skills and MCP servers |
| Models | Local model files and the remote models agents used, and which agents used them |
| Skills & plugins | Everything installed into the agents |
| MCP servers | Every MCP server entry, its client and the tools seen |
| Devices | Each reporting computer, its person and the last report |
Opening an agent shows its access summary, the projects it worked in, its credentials by name, and its sessions. Opening a session draws the chain as a diagram (prompt → agent → tools → sub-agents → their calls) and as a plain timeline. Opening a model shows where it lives and which agents used it and when.
Turning it on
- Safeguard enables the feature for your organisation (feature
inventory:ai_agent_discovery, off by default). - An administrator turns it on for the organisation and chooses the policy: how file paths are shown, whether command lines and web search queries are collected, extra model folders, how often devices report, retention, enrollment (each person is asked, or everyone is enrolled with a notice) and whether people may opt out.
- Each person allows it on their computer, after reading exactly what is collected:
- in Safeguard Desktop: Settings › Privacy › AI agent discovery › Allow AI agent discovery;
- in the CLI:
safeguard aidr collect on.
From then on it runs in the background while the Safeguard runner or Desktop is running, every interval the organisation sets (15 minutes by default).
CLI
safeguard aidr collect status # your organisation's setting, your choice, the last delivery
safeguard aidr collect on # read the notice and allow it
safeguard aidr collect show # print exactly what the next run would send (nothing is sent)
safeguard aidr collect --dry-run # collect locally and summarise, send nothing
safeguard aidr collect # collect and send once now
safeguard aidr collect off # stop, and delete what was sent from this computer--json prints machine-readable output; --output <folder> writes the batches to disk instead of sending them.
Privacy
| By default | Collected |
|---|---|
| Tool names, tool classes, order, timing, counts | Yes |
| Models and token counts | Yes |
| File paths | Shortened: your home folder becomes ~ and other people's account names are removed. The organisation can choose a one-way hash instead, or full paths |
| Shell commands | The program name only (git, npm, curl); arguments only if the organisation turns command lines on, with credentials masked |
| Web fetches | The domain only |
| Web search queries | Only if the organisation turns them on, with credentials masked |
| Prompts, responses, full tool inputs | No. Only if Safeguard enables prompt capture for the organisation (inventory:ai_agent_content), the administrator turns it on, and the person separately agrees. Even then the text is masked for credentials, email addresses and similar personal details and cut to 2,048 characters |
| Credential values | Never. Credential files are only checked for presence; they are never opened |
| Tool output, file contents | Never |
Everything is redacted on the computer before it is queued, and the platform applies the same rules again when it arrives. Records are kept for the organisation's retention period (30 days for activity by default). Turning it off on a computer deletes what that computer sent and records the person's choice, so no client enrolls them again.
No customer data from AI agent discovery is sent to any AI model or third-party AI provider.
Supported agents and what is read
| Agent | Configuration and access | Skills, plugins, extensions | Activity (sessions) |
|---|---|---|---|
| Claude Code | ~/.claude/settings.json, settings.local.json, managed settings, project .claude/settings*.json, ~/.claude.json | ~/.claude/skills, agents, commands, installed plugins and marketplaces | ~/.claude/projects/*/*.jsonl and sub-agent transcripts |
| OpenAI Codex CLI | ~/.codex/config.toml (or $CODEX_HOME) | ~/.codex/skills, plugins and marketplaces in config.toml, AGENTS.md | ~/.codex/sessions/**/rollout-*.jsonl |
| Cursor | ~/.cursor/cli-config.json, project .cursor/cli.json, ~/.cursor/mcp.json | ~/.cursor/extensions, project .cursor/rules | Through Safeguard's Cursor hooks (safeguard aidr install --agent cursor) |
| GitHub Copilot | VS Code settings (chat.tools.*.autoApprove, chat.permissions.default), ~/.copilot/mcp-config.json | Copilot extensions, .github/copilot-instructions.md, .github/instructions, .github/prompts, .github/agents | Not supported yet |
| Gemini CLI | ~/.gemini/settings.json, project and system settings | ~/.gemini/extensions, ~/.gemini/commands, GEMINI.md | Not supported yet |
| Windsurf | ~/.codeium/windsurf/mcp_config.json | global rules, project .windsurf/rules | Not supported yet |
| Cline, Roo Code | MCP settings in VS Code's extension storage | extensions, .clinerules, .roo/rules, .roomodes | Not supported yet |
| Continue | ~/.continue/config.yaml (models), MCP servers | rules and prompts | Not supported yet |
| Aider | ~/.aider.conf.yml | — | Never read: Aider's history files hold the conversation itself |
| Local models | — | — | Ollama, LM Studio, Hugging Face cache, Jan, and folders your organisation lists |
Each report says, per agent, whether its sessions were read, not supported, or had no local files, so a gap is never shown as "nothing happened". Claude Code and Codex activity can also arrive through their OpenTelemetry export to Safeguard; both sources describe the same events.
Related
- Asset discovery — repositories, containers and the asset graph.
- Desktop app — Settings › Privacy.
- AI-SPM — AI security posture.