↓ Skip to main content
karmine’s notes
  1. Tags/

Agentic-Ai

Seeing the AI Layer: Detecting Agents, MCP Servers, and IDE Plugins on Every Endpoint with osquery

·2187 words·11 mins
Security-Ops Fleet Osquery Ai Mcp Detection-Engineering Security-Ops Agentic-Ai Supply-Chain Threat-Hunting
Your EDR knows about processes and network connections. Your MDM knows about installed apps. Neither one knows that someone on your team is running an npx-fetched MCP server that has shell-exec capability and a plaintext secret baked into its config. agentic-detector is a cross-platform osquery extension that fixes that. One table — ai_tools — gives you the full AI software inventory per host: MCP servers, agent CLIs, IDE plugins, desktop apps, live network sockets, and the agent instruction files that tell AI what it’s allowed to do. Deployable through Fleet in minutes.