Agents

What this is for

AI Supply Chain → Inventory → Agents (/supply-chain/inventory?tab=agents) lists every AI agent Guardway has found:

On your endpoints, from the Guardway endpoint agent: agent definition files an AI tool loads (for example ~/.claude/agents/*.md), and code whose dependencies include an agent framework or a model SDK.
In your cloud accounts, from the cloud connectors: Azure AI Foundry and Amazon Bedrock agents, with their models, tools, MCP servers, gateway routing, linked Entra ID identities and OWASP Top 10 for Agentic Applications findings.

The tab opens with the agents most likely to run at the top, so a reviewer starts with what an installed AI tool loads on its next session rather than with code cloned for a course. Click a row to open its detail sheet. Org-wide totals and finding breakdowns live on Dashboard → Agents.

Endpoint agents appear once the endpoint agent reports. Cloud agents need at least one cloud AI integration under Settings → Integrations and a first completed sync.

Connectors

Source	Status	Set up under
Endpoint agent (gw-cli)	Available	Guardway CLI
Azure AI Foundry	Available	Settings → Integrations → Azure AI Foundry
Amazon Bedrock	Available (Bedrock Agents and AgentCore)	Settings → Integrations → Amazon Bedrock
Microsoft Entra ID	Available, identity hydration only	Settings → Integrations → Microsoft Entra ID
GCP Vertex Agents	Coming soon	—

Origin tells endpoint rows from cloud rows. Azure AI Foundry and Amazon Bedrock each discover agents for their cloud; an org with several accounts or subscriptions of one provider sees each row named with the connection that found it. Microsoft Entra ID does not add agents. It hydrates each discovered cloud agent with execution identity (Service Principal or Managed Identity), owners, credential lifecycle, OAuth grants and directory roles for ASI03 rules. Identity sync runs after a successful Resync on the Azure AI Foundry card (or after Test Microsoft Graph access on the Entra card). The Azure AI Foundry connector discovers both prompt agents (default in the New Foundry experience) and legacy Assistants-API agents.

Inventory

Definitions scanned

A line under the Agents heading names the AI tools whose agent definition folders the sensors walk, for example: “Agent definitions scanned for Claude Code. Other AI tools’ definitions are not reported.” An agent defined for a tool that is not named there is not missing, it is not reported. When some machines walk more tools than others, the line says on how many (for example “Kiro and OpenCode on 1 of 7 machines”), and the info button lists the folders walked for each tool. With a machine picked, the line describes that machine’s sensor. Sensors that do not report their folders walk ~/.claude/agents, and .claude/agents inside a project except on Windows. Agents provided by Claude Code plugins are not walked.

Filters

Element	Notes
Search agents	Matches every value the row shows, including the Runs via repository or folder, the Likely to run label and the evidence class.
Machine	All machines, or one machine. A picked machine stays in the URL (`host=`), and both the rows and the detail sheet then show that machine’s own reading. Cloud agents only appear when Origin asks for them.
Origin	Every origin, Endpoint or Cloud.
Likely to run	One rung of the ladder below, listed top-down.
Runs via	One harness, cloud platform, repository, folder, plugin marketplace or editor extension. Folders and repositories are labelled as such, so a folder that shares a tool’s name is never mixed with the tool.
Refresh	Reloads the inventory.

Columns

Column	Notes
Agent	The agent’s name, tagged `subagent` for a definition file, or with the dependency markers that made the endpoint agent list it (`langgraph`, `openai`, “MCP server”). Hover for its path.
Origin	Endpoint or Cloud.
Runs via	What would run it: the harness that loads a definition (Claude Code, Kiro, Cursor, …), the cloud platform and its connection, or the repository, folder, plugin marketplace or editor extension the code sits in. A repository shows `org/repo` once the endpoint agent reports the checkout’s remote, and its folder until then.
Likely to run	The rung, below. The default sort: highest rung first, worst verdict first inside a rung.
Models	A cloud agent’s model deployments. The endpoint agent does not report a model for a definition, so it reads not reported.
Tools	A cloud agent’s tools, or the tool grant a definition declares. A definition with no tools line inherits every tool and reads all (inherited, broad), and one that grants no tools reads none. The endpoint agent marks a grant (broad) when it includes `` or a tool that can run shell commands: Bash, a tool named for a shell, terminal, command or execute, or Kiro’s `@builtin`. A grant written as the tools switched off reads all except …, and is marked (broad)* unless `*` or the shell is among the tools switched off.
Machines	Endpoint machines it was seen on.
Last seen	Days since the newest sighting.
Verdict	The scan result. Agent code the endpoint agent does not score reads not scored, or partly scored when only some machines scored it, never clean.
Authorization	What the organisation has decided about it.

Likely to run

Rung	Meaning
Deployed	Hosted in a cloud platform. Whether an application calls it is not reported; its routing and status are in the note.
Armed	A definition whose harness is in this machine’s tool inventory: it loads when that harness next runs. The note says how the harness was found.
Local code	Not loaded as an installed definition: code, or a definition outside an active harness directory. Whether anything runs it (a service, an MCP client, a scheduled job) is not reported.
Harness missing	A definition for a harness that is not in this machine’s tool inventory.

The note beside each rung says what the reading rests on: how the harness was found (installed, an enabled extension, only its config directory, or installed but disabled in an editor profile) and whether it is signed in; a cloud agent’s gateway routing and status. A gateway route is configuration, not observed traffic, so it never lifts a cloud agent above Deployed. Instruction files (rules, steering, guidelines, AGENTS.md) are not agents: they are listed under Add-ons. For agent code, the note begins with where the code sits: “Checkout of a repository” or “Checkout; no remote reported” in a checkout the endpoint agent reported, and in a folder “No git checkout found” when that machine’s endpoint agent reports checkouts, or “Folder; no checkout reported” when it does not. Code in a Claude Code plugin copy, and a definition the endpoint agent reports as one, is Local code and reads “Plugin marketplace copy; whether the plugin is enabled is not reported” or “Plugin cache; whether the plugin is enabled is not reported”.

Agent evidence

How Guardway knows a row is an agent. A dependency is not an agent, so each class says what was found and nothing more.

Evidence	Meaning
Definition	A definition file a harness loads; its tool grant is read from it (no tools line means every tool).
Agent framework	Depends on an agent-loop framework. Whether the code runs an agent loop is not reported.
LLM library	Depends on an LLM library. Whether the code plans or calls tools is not reported.
Model SDK	Depends on a model SDK. It can call a model; whether it plans or calls tools is not reported.
MCP server SDK	Depends on the MCP server SDK: most likely a tool server that agents call, not an agent.
Unrecognised marker	The sensor reported a dependency marker this console does not classify.
No marker	The sensor reported no dependency marker.
Cloud platform	Listed as an agent by the cloud platform that hosts it.

When the endpoint agent matches an MCP server configured in an AI tool to one of these code folders, by the server’s command, arguments or working directory, the server’s sheet on the MCP tab shows that folder as Source folder. When machines matched the server to different folders, all of them are listed, and none is offered to copy. When the folder’s only marker is the MCP server SDK, the code is listed only there, as that MCP server, and not here as an agent; with any other marker it is listed in both places. An endpoint agent that does not report the match lists the code here, so the Agents count can drop when a machine’s endpoint agent is updated.

Agents inventory table — Inventory → Agents

Findings

Open Findings from the Agents tab (/supply-chain/inventory?tab=agents&view=findings) for the org-wide OWASP list of cloud agents.

Element	Notes
Search findings…	Filters by finding title, description, rule id, or agent name.
All categories	Default, or filter to one ASI code (`ASI01` … `ASI10`). The dropdown lists full names; the table Category column shows the short code only (`ASI03`, `ASI02`, …).
All severities	Default, or `Critical`, `High`, `Medium`, `Low`, `Info`.
Refresh	Reloads findings.

Columns

Sorted by severity (highest first), then category, then rule id.

Column	Notes
Severity	Color-coded chip.
Category	ASI code chip (short form in the grid).
Agent	Links to agent detail. Shows a monospaced row id if the agent was removed.
Finding	Rule title above, description below.
Rule	Stable id (e.g. `asi03.shared_identity_across_agents`).
Last seen	Date the finding was last observed.

Empty state: No OWASP findings detected. with a green shield icon.

OWASP findings table — Agents → Findings

Agent detail

Opens as a sheet when you click a row; previous / next step through the rows in their current order.

Endpoint agents

Field	Notes
File / Location	A definition’s file, or the code’s directory (the endpoint agent reports the project folder whose manifest matched). Inside a folder or checkout, the path relative to it is shown too.
Manifest	The file whose dependencies made the endpoint agent list it, once the agent reports it.
Tool grant / Markers	A definition’s declared grant, or the code’s dependency markers.
Likely to run	The rung and its note. With several machines and none picked, it says whose reading the row shows (Strongest of N machines (…)).
Agent evidence	The evidence class and its sentence.
Loaded by / Harness	The harness. Loaded by only when it is Armed; otherwise Harness, with “Not in this machine’s tool inventory.” when it is missing.
Repository / Folder / Plugin marketplace / Editor extension	Where the code sits. A checkout with no remote reads “checkout; no remote reported”. A folder reads “no git checkout found” when that machine’s endpoint agent reports checkouts, and “no remote reported; showing the folder” when it does not.
Score	The scan score, or not scored.
Where it was observed	Each machine, with its own rung and verdict.

Cloud agents: header

Agent name, provider · project · account label, Routing unknown / gateway badge, an optional worst-severity chip and N ASI finding(s) anchor to the findings card, and Open in console when raw_url is present.

Cloud agents: sections (in order)

Section	Notes
OWASP Top 10 findings (N)	Grouped by ASI category. Remediation and Evidence collapsibles per finding; Evidence shows JSON from the rule evaluator.
Identities (N)	One row per Entra principal. Display name, type chip (`ServicePrincipal`, `ManagedIdentity`, `Application`), link source (`Foundry account managed identity`, `Declared in agent metadata`, `Assistant owner`). Object id, Attached to for Managed Identities, owner count (suppressed for MIs with an attached resource), credential badges (N expired, N expiring <30d), N risky scope(s). Hidden when no identity resolved.
Models (N)	Deployment name, provider kind, deployment alias, endpoint URL.
Tools (N)	Name, description, kind chip.
MCP servers (N)	Name, URL, transport, risk badge.

Footer: last discovered timestamp.

Agent detail with OWASP findings and Identities — Agent detail

OWASP Top 10 categories

Guardway maps findings to the OWASP Top 10 for Agentic Applications 2026 framework. Five categories are evaluated in this release from passive cloud metadata; the rest are deferred (Limits).

Category	Title	Evaluated
ASI01	Agent Goal Hijack	No
ASI02	Tool Misuse & Exploitation	Yes
ASI03	Identity & Privilege Abuse	Yes
ASI04	Agentic Supply Chain Vulnerabilities	Yes
ASI05	Unexpected Code Execution (RCE)	Yes
ASI06	Memory & Context Poisoning	No
ASI07	Insecure Inter-Agent Communication	Yes
ASI08	Cascading Failures	No
ASI09	Human-Agent Trust Exploitation	No
ASI10	Rogue Agents	No

Rule reference

ASI02 · Tool Misuse & Exploitation

Rule	Severity	Triggers when
`asi02.code_interpreter_present`	Medium	The agent has a `code_interpreter` tool registered.
`asi02.high_tool_count`	Low	More than 10 tools.
`asi02.unknown_kind_tool`	Info	A tool kind could not be classified.

ASI03 · Identity & Privilege Abuse

Rules below no_managed_identity_hint require Microsoft Entra ID and a resolved agent → principal link.

Rule	Severity	Triggers when
`asi03.no_managed_identity_hint`	Medium	Privileged-looking tools, no Entra principal linked, no identity in metadata.
`asi03.shared_identity_across_agents`	Medium	Same Entra principal across multiple agents.
`asi03.expired_credential`	High	Expired client secret or certificate on the identity.
`asi03.credential_expiring_soon`	Medium	Credential expiring within 30 days.
`asi03.long_lived_secret`	Medium	Client secret lifetime greater than one year.
`asi03.overprivileged_consent`	High	High-risk Microsoft Graph permissions on the identity.
`asi03.privileged_directory_role`	Critical	Global Administrator, Privileged Role Administrator, Application Administrator, or Cloud Application Administrator.
`asi03.orphaned_principal`	Medium	Service Principal or Application with no owners (MIs exempt).
`asi03.disabled_owner`	Medium	All user owners disabled.
`asi03.unverified_principal`	Low	Metadata principal id does not match any tenant principal.
`asi03.dormant_principal`	Low	No sign-in for 90+ days (`AuditLog.Read.All` + AAD Premium required).

ASI04 · Agentic Supply Chain Vulnerabilities

Rule	Severity	Triggers when
`asi04.mcp_server_unpinned_url`	High	MCP host outside trusted allowlist.
`asi04.openapi_external_spec`	Medium	OpenAPI spec URL outside allowlist.
`asi04.mcp_server_no_url`	Low	MCP server has no URL recorded.

ASI05 · Unexpected Code Execution (RCE)

Rule	Severity	Triggers when
`asi05.code_interpreter_present`	High	`code_interpreter` tool present.
`asi05.shell_like_function_tool`	High	Function tool matches shell/eval patterns.

ASI07 · Insecure Inter-Agent Communication

Rule	Severity	Triggers when
`asi07.mcp_http_transport`	High	MCP uses `http` transport or `http://` URL.
`asi07.mcp_unknown_transport`	Medium	Transport unknown from discovery.

Severity meanings

Severity	Typical impact
Critical	Direct path to compromise without further conditions.
High	Material risk under common attack paths.
Medium	Increased attack surface or reduced visibility.
Low	Hygiene issue.
Info	Diagnostic / connector visibility gap.

Lifecycle

Findings are created on first rule match, updated on each sync when the rule still fires, and pruned automatically when the rule stops firing. Deleting an agent in the provider removes its findings.

Gateway routing detection

Hostname of the model endpoint is compared to registered gateway URLs.

State	Meaning
Gateway: <name>	Endpoint matches a registered gateway.
Bypassing gateway	Direct to upstream provider.
Routing unknown	Endpoint URL not resolved (common for Foundry prompt agents).

Limits

Endpoint agent definitions are reported only from the folders named under the Agents heading (see Definitions scanned).
One subscription (Azure) or account+region (Bedrock) per provider per organization in v1.
Refresh is on-demand via integration Resync; no continuous background poll yet.
OWASP evaluation is passive — Guardway never sends prompts to discovered agents.
Five ASI categories evaluated (ASI02, ASI03, ASI04, ASI05, ASI07).
ASI04 allowlist: until seeded, MCP hosts may all trigger asi04.mcp_server_unpinned_url.

Dashboard → Agents — org-wide metrics and breakdowns.
Topology — graph of gateways → providers → models → agents.
Settings → Integrations — connect providers.
Logs — request history for gateway-routed traffic.

Getting Started

Platform

Gateway

Discovery

Endpoint AI Risk

Resources

API Reference

What this is for

Connectors