OpenA2A CLI
Shadow AI detection
Inventory the AI assistants, MCP servers and AI config files in a project, and the machine-wide configs the CLI reads, with one command. Governance score. Executive report.
What your existing tools record, and what they leave out
Developers install AI coding assistants, MCP servers, and autonomous agents with one command. Claude Code, Cursor, GitHub Copilot, Devin Desktop (formerly Windsurf), custom MCP servers: each one operates with access to source code, credentials, and internal systems.
Your existing tools record parts of this. An EDR sensor logs the agent's processes, the commands it runs and the hosts it connects to; a CASB or network proxy logs the AI services it calls. None of those event logs holds the contents of an MCP config file, which is where an agent is granted filesystem, database and command access. What EDR, CASB, a proxy and a local scan each observe, with sources.
The opena2a detect command reads that part. It scans developer machines for running AI processes, MCP server configurations, AI tool config files, and embedded credentials, then produces a governance score, an executive HTML report, and CSV export for your asset management systems.
What detect finds
Three categories of shadow AI artifacts, inventoried per project and from the machine-wide configs the CLI reads.
Running AI Agents
Process-level detection of 20 AI coding tools and local model runtimes. Identifies running instances of Claude Code, Cursor, Copilot, Devin Desktop, Aider, Continue, Cody, and more.
- Process name and PID detection
- Working directory identification
- Version and configuration extraction
MCP Servers
Discovers MCP server configurations and translates raw JSON capabilities into plain-language descriptions of what each server can access.
- Filesystem, database, and API access
- Capability enumeration in plain language
- Server origin and trust assessment
AI Configuration Files
Locates AI tool configuration files, rules files, and settings that define agent behavior, permissions, and credential access.
- .cursorrules, .claude/, .github/copilot
- Embedded credentials in config files
- Permission and access scope analysis
Governance score: 0 to 100
Every scan produces a governance score that quantifies your shadow AI exposure. The score uses recovery framing: it shows the path forward, not a grade.
+55 recoverable by completing remediation steps
Remediation flow
opena2a detectInventory the AI agents, MCP servers and configs the CLI can see
opena2a identity createRegister each agent with a verifiable identity
opena2a harden-soulApply governance policies and access controls
opena2a detectRe-run detect to confirm the inventory is governed
Enterprise reporting
Output formats designed for security teams, compliance audits, and asset management systems.
Executive Report
--reportGenerates an HTML dashboard with governance score breakdown, agent inventory table, MCP capability matrix, and prioritized remediation steps. Share with leadership without requiring CLI access.
CSV Export
--export-csvExports discovered agents and MCP servers as CSV for import into ServiceNow, CMDB, or any asset management system. Each row includes agent type, version, capabilities, credential access, and governance status.
Community Trust Data
Cross-reference detected agents and tools against community-reported trust data and known vulnerabilities.
Find your shadow AI in 30 seconds
No signup, no agent install, no network access required. Runs locally on each developer machine.
$ npx opena2a-cli detectStay Updated on AI Agent Security
Subscribe to our newsletter for weekly insights, vulnerability alerts, and best practices