Agent Discovery

A first-day discovery report should reveal unknown agents, overprivileged identities and unused credentials before enforcement is enabled.

Priority: P0
Phase: MVP
Primary owner: Platform / Integrations
Status: Blueprint

Objective

Discovery is the entry point because enterprises cannot govern agents they do not know exist. The engine should combine API enumeration, cloud metadata, identity/service-account analysis, source-code/config scanning and observed runtime traffic to identify both sanctioned and shadow agents.

What to build

Discover agents from model platforms, agent frameworks, cloud services, identity systems, source repositories and gateways.
Identify MCP servers, tool registries, service accounts, API credentials and applications associated with each agent.
Classify discovered objects as confirmed agent, probable agent, supporting workload or unknown.
Correlate duplicates across providers and environments into one logical agent record.

Implementation decisions

Build connector-specific evidence rules rather than labeling every service account as an agent.
Maintain confidence score and reasons for each discovery classification.
Support scheduled scans plus streaming updates/webhooks where providers offer them.
Allow customers to suppress known false positives without deleting raw evidence.

Definition of done

A new supported agent appears in inventory within the defined discovery SLA.
Every discovered agent has source evidence and confidence metadata.
Unowned and stale agents can be filtered and exported for remediation.

Success metrics

Agents discovered
Shadow/unowned percentage
Discovery precision
Mean time from creation to detection

LANDING FEATURE

A first-day discovery report should reveal unknown agents, overprivileged identities and unused credentials before enforcement is enabled.

This control is specified on page 14 of the blueprint.