I'm a Security Team Assessing AI Risk

You need to understand what AI agents are running across your organization, assess their security posture, and produce documentation for audits and compliance reviews.

Time to complete: approximately 10 minutes per machine. Fleet aggregation adds 5 minutes.

Step 1: Build an AI Asset Inventory

Export a CSV of every AI agent and MCP server detected on the machine. This format imports directly into ServiceNow, Jira Assets, or any CMDB that accepts CSV.

Shadow AI Discovery
===================

Scanning processes, configs, and network...

Found 5 AI agents, 8 MCP servers across 3 users.

Exported to: assets.csv (13 rows)

CSV columns:
  type, name, version, pid, user, mcp_count,
  governance, credential_protection, last_seen

Step 2: Generate an Executive Report

Create an HTML dashboard suitable for sharing with leadership. The report includes risk scores, governance gaps, and remediation priorities. No terminal required to view it.

Shadow AI Discovery Report
==========================

Generated: shadow-ai-report.html

Summary:
  Total AI agents:      5
  Governed:             2 (40%)
  Credential protected: 1 (20%)
  MCP servers:          8
  Signed configs:       3 (37%)

Risk level: HIGH
  - 3 agents with no governance file
  - 4 agents with exposed credentials
  - 5 MCP servers with unsigned configs

Open shadow-ai-report.html in a browser to view the full dashboard.

Step 3: Check Community Trust Data

Query OpenA2A community trust data for trust scores and known vulnerabilities associated with each detected agent and MCP server.

Step 4: Run a Full Security Review

The review runs six phases in sequence: project scan, credential scan, guard verification, shield analysis, HMA scan, and shadow AI detection. It combines them into one composite score out of 100 and writes an HTML report with the findings for each phase. Pass --report to keep the report at a path you choose; without it the report goes to a temporary file.

  OpenA2A Security Review

  [1/6] Scanning project...
  [2/6] Checking credentials...
  [3/6] Verifying config integrity...
  [4/6] Analyzing shield events...
  [5/6] Running HMA security scan...
  [6/6] Detecting shadow AI...

The command prints one line per phase as it runs, each followed by the time the phase took. After the sixth it prints the composite score, the points the top fixes would recover, the number of findings by severity, and the report path. The review command reference gives the weight of each phase in the score.

To feed findings into a ticketing system, write the same results as JSON:

Step 5: Integrate with Your Audit Workflow

Attach the generated artifacts to your existing audit and compliance processes.

• ServiceNow: Import assets.csv into your CMDB as AI asset records.
• Jira / tickets: Each entry in the findings array of review-report.json carries a title, severity, detail, and remediation; create one remediation ticket per entry.
• Audit evidence: Attach shadow-ai-report.html and review-report.html as evidence of AI governance review.
• Compliance frameworks: Map findings to NIST AI RMF, ISO 42001, or SOC 2 controls.

Aggregating Across a Fleet

Run detection across multiple machines and merge the results into a single inventory.

# On each machine:
opena2a detect --export-csv assets-$(hostname).csv --ci

# Merge all CSVs (keep one header row):
head -1 assets-machine1.csv > fleet-inventory.csv
tail -n +2 -q assets-*.csv >> fleet-inventory.csv

The merged CSV provides a single view of all AI agents and MCP servers across your organization, ready for import into your asset management system.