Shadow IT Always Left a Trail. Shadow AI Doesn't.
A developer installs Cursor to ship a feature faster. It gets read and write access to the repository, and it inherits whatever is already in the shell: the cloud keys, the database URL, the production token exported for a quick test. From that moment an autonomous process is acting with the authority of whatever credentials were in that shell. Your identity stack never recorded a thing, because nothing logged in.
Every previous class of shadow IT eventually showed up in a log. Shadow AI doesn't. That one difference is why the tools that caught the last decade of unsanctioned software are blind to this, and why the problem needs a different first move.
Every shadow IT problem used to end up in a log
The reason shadow IT became manageable is that it left evidence. A new SaaS app showed up as an SSO login. An unsanctioned OAuth grant showed up in a CASB report. Unapproved software showed up in endpoint inventory. The discovery problem was solved by instrumenting the chokepoints every tool had to pass through: a login, a token, an installer.
An AI agent passes through none of them. Claude Code, Cursor, and Windsurf install with one command and run as an ordinary local process. There's no login page, no OAuth grant your directory issued, no network traffic your SIEM recognizes as an agent. The agent exists as a process and a handful of config files, and that's the entire footprint.
Shadow IT eventually shows up in a log. Shadow AI shows up in an incident.
The agent you can't see is the one holding your credentials
Invisibility would be a minor problem if these agents did minor things. They don't. An agent runs with delegated authority to read, write, and execute on the developer's behalf, and it inherits the credentials already present in the environment it started in. The thing your tools can't see is the same thing that can reach source code, cloud accounts, and databases.
Then it grows. Many agents connect to MCP servers, and each server is another capability handed over: run commands on this machine, query this database, call this payment API. In practice, few developers who wire in an MCP server can say, a week later, exactly what they granted. The attack surface expands quietly, one config edit at a time, with no review and no record.
The scale is measured, even though your laptop isn't
The supply side of this isn't a guess. The OpenA2A Registry has trust-scored more than 293,000 MCP servers, AI skills, and A2A agents. Most of what a developer installs has never been checked against any of it. The components are cheap to add and almost never verified before they run.
We can't tell you how many are running on your machines, and we built it that way on purpose. opena2a detect runs locally and sends us nothing: no account, no upload, no callback. The only number that describes your environment is the one you produce by running it yourself.
Discovery is the first move, not the product
You can't govern what you can't see, so the first move is to make the invisible legible. One command, no account, runs locally in seconds, and answers the only two questions that matter to start: what AI is actually running here, and is any of it governed?
npx opena2a-cli detectIt reads the process list and config files for the agents that leave a local footprint (Claude Code, Cursor, Windsurf, Copilot, and others), the MCP servers wired into each, and the AI config files that grant them permission. It describes each MCP server's capabilities in plain language, because “can run commands on your computer” is more useful to a reviewer than a JSON blob. Everything rolls up into a governance score with a recovery path, so the output isn't a verdict but a worklist.
Seeing an agent isn't governing it
Discovery is worth nothing on its own. It earns its place by making three outcomes possible.
Know what exists. The discovered inventory is the asset register your SOC 2 and ISO 27001 auditors keep asking for and your spreadsheet keeps failing to produce. It's machine-readable and diffable, so the baseline is a file in version control, not a memory.
Produce proof on demand. “Which ungoverned agents appeared this quarter” becomes a query instead of an investigation, because the output is structured JSON a SIEM can ingest.
Give each one an identity. A discovered agent gets a project identity and governance rules; a discovered MCP server gets a signed Ed25519 identity, so the next scan can tell a verified server from an unsigned one. That's the move from inventory to control.
The evidence outcome is the one a CISO will ask to see. A scan returns structured findings, and every finding carries its own remediation, so the path from a high-risk score to a governed one is the worklist the scan already handed you:
{
"summary": { "totalAgents": 1, "ungoverned": 1, "mcpServers": 14, "governanceScore": 45 },
"findings": [
{
"severity": "high",
"title": "No agent identity for this project",
"whyItMatters": "Without an identity there is no way to attribute what this agent did.",
"remediation": "opena2a identity create --name my-project"
}
]
}What detect won't do
It's a local discovery tool with real edges. It reads the process list and config files, so it finds agents that leave a footprint on disk. An agent that runs entirely in a browser tab, or a remote service you never configured locally, is outside its reach. It's not a network scanner and it's not an EDR.
And because it sends us nothing, there's no central dashboard of your fleet and no number we can quote back to you. That's a deliberate trade: privacy over telemetry. Discovery is also not governance. Finding an ungoverned agent changes nothing until you give it an identity and rules. The tool makes the problem visible. Closing it's still a decision you make.
Shadow IT got governed once we could see it. The logins, the tokens, the installers became chokepoints we could instrument, and visibility turned an unmanaged sprawl into an asset register. Shadow AI gets governed the same way. The seeing simply has to be rebuilt for agents that never log in.
It's running on your developers' machines today, inheriting their credentials and leaving no trail. The first move is the one command that finally gives it a trail.