To inventory AI agent tooling across developer machines, combine four sources: configuration files in repositories, a survey or scripted check of developer machines, identity provider records of connected apps, and network records of calls to tool servers. No single source is complete, and the overlap shows what you missed.
Why one source fails
Repository configs show what is committed. They miss what a developer added to a personal config. A machine check shows what is installed, but only on machines you reach. Identity records show authorized apps, not local servers. Network records show traffic, not intent.
Each source has a blind spot the others cover.
The four sources
| Source | Finds | Misses |
|---|---|---|
| Repository configs | Shared servers and agent settings | Personal and local setups |
| Developer machines | Installed assistants, servers, extensions | Unmanaged devices |
| Identity provider | OAuth grants to AI apps | Local only tools |
| Network records | Traffic to tool servers and model providers | Offline use |
Steps
- Define the item types. Coding assistants, IDE extensions, MCP servers, agent frameworks, model files.
- Search repositories for known config file names and server declarations. Record owner and path.
- Ask developers. A short form beats a mandate: what do you use, what can it reach, who set it up. Promise no punishment for honest answers, or you will get quiet ones.
- Check machines where you have management tooling, for the same item types.
- Review identity grants for AI apps and tool servers, with scopes.
- Reconcile. Merge into one list. Flag items found in only one source.
- Assign an owner to every item. Unowned items are the first review queue.
What to record per item
Name, type, version, owner, where it runs, identity used, what it can reach, approval status and date last seen. Keep it to these first. See agent registry entry fields for a fuller list.
Handling the surprises
You will find tools nobody approved. That is normal and not a reason for blame. Triage by access: anything that can write code, run commands or reach production data goes first. The MCP specification advises a human in the loop who can deny tool calls, so check that approval prompts are not disabled.
For one class of risk, see detecting shadow MCP servers.
Keeping it current
Run the reconciliation monthly and track one number, items found that were not in the list. If it falls, your process is working. If it rises, your developers are adopting faster than you are approving, which is a signal to speed up approval, not to tighten rules.
Try it yourself
The dependency inventory demo shows how components are collected into a single view. Think about how agent tooling would appear beside packages.
Click through it at your own pace, or open it full screen.
Safeguard provides asset discovery, agent identity and SBOM and dependency scanning that can feed such an inventory. A free scan is at gold.safeguard.sh/scan.
Quick check
Do we need to inventory personal AI accounts?
Inventory what touches company code or data. Personal use outside that is a policy question, not an inventory one.
How often should the inventory refresh?
Monthly for reconciliation, with change alerts between if your tools offer them.
Sources
Last reviewed: 19 October 2026.
