AI Discovery

Most security teams find that the first useful question DefenseClaw answers isn't "did you block X?" — it's "what AI is even running on this machine?" AI Discovery is the four-surface inventory pipeline that answers it.

The TUI's AI Discovery view (above) is the operator-facing rendering of the same pipeline this page documents — a live table of every detected AI agent, model, MCP server, skill, and package dependency with per-signal identity / presence confidence scores.

The four are independent — you can run any subset. Most teams start with defenseclaw agent discover to see what's there, then turn on continuous discovery in the gateway, then add AIBOM for compliance evidence.

Run it now: 30-second tour

defenseclaw agent discover

That's it. The CLI walks the known connector paths (Claude, Codex, Cursor, OpenClaw, Hermes, Windsurf, Copilot CLI, Gemini CLI, …), checks for config files and binaries, probes versions inside trusted prefixes, and prints a table of what's installed.

Add --json for machine-readable output or --emit-otel to also publish a sanitized report to the gateway so Splunk and Grafana light up:

defenseclaw agent discover --json --emit-otel

How the four surfaces relate

What gets discovered

The continuous scanner (internal/inventory/ai_discovery.go) classifies every signal into one of the categories below. The on-demand CLI fills in connector-specific metadata for the same categories.

Every signal carries state ∈ {new, changed, gone} with last_seen / first_seen timestamps so the dashboards can show drift over time, not just point-in-time snapshots.

Continuous discovery (gateway)

The continuous scanner runs inside the gateway and emits ai_discovery events whenever a signal transitions state. It's off by default — turn it on once you have observability wired up:

defenseclaw agent discovery enable --restart --scan

defenseclaw agent discovery status

defenseclaw agent discovery scan

defenseclaw agent discovery disable

Tunable knobs

agent discovery enable accepts a wide tunable surface so you can scope the scan to your environment:

Signature packs are managed separately under defenseclaw agent signatures (see below); there is no --signature-pack flag on discovery enable.

Run defenseclaw agent discovery enable --help for the full list with defaults.

Signature packs

The scanner uses a versioned signature pack to know what an "AI artifact" looks like. Packs are managed independently of the binary so we can ship new connector support without a release:

defenseclaw agent signatures list
defenseclaw agent signatures install <pack>
defenseclaw agent signatures validate <path>
defenseclaw agent signatures disable <id>
defenseclaw agent signatures enable <id>

The bundled pack covers every connector listed in Capability matrix. Custom packs are useful when you ship internal AI tooling and want it surfaced as a first-party signal rather than unknown.

On-demand discovery (CLI)

defenseclaw agent is the operator-side surface — instant answers from a single shell invocation, no gateway required.

agent discover

defenseclaw agent discover --json --emit-otel

Walks the connector specs (KNOWN_CONNECTORS in cli/defenseclaw/inventory/agent_discovery.py) and reports:

Notice what's not included: no full paths, no env values, no command output, no file contents. The on-demand report is sanitized at the source, then signed and sent to the gateway. See Privacy and trust model below.

agent usage, processes, components

These three queries hit the gateway's AI usage view (built from continuous discovery), not the local filesystem:

defenseclaw agent usage --state new --state changed --json

defenseclaw agent processes --limit 20

defenseclaw agent components --ecosystem npm --min-identity 0.8
defenseclaw agent components show ai-sdk
defenseclaw agent components history ai-sdk

agent confidence

Discovery isn't binary — every signal has a confidence score. To inspect what evidence backed a particular decision:

defenseclaw agent confidence explain claudecode
defenseclaw agent confidence policy show
defenseclaw agent confidence policy default
defenseclaw agent confidence policy validate ./my-policy.yaml

explain shows the per-detector evidence trail. policy lets you tune the weights — useful when you have an internal connector that scores low because the bundled signature pack doesn't know about it.

AIBOM (AI Bill of Materials)

Discovery answers "what's there?" AIBOM answers "what's there, with provenance, in a format I can hand to compliance."

defenseclaw aibom scan --json

For OpenClaw, aibom scan calls the live openclaw binary in parallel for each category (skills, plugins, MCP, agents+config, models, memory) and merges the results. For non-OpenClaw connectors it falls back to filesystem inventory.

The output is a custom JSON document with per-item provenance stamped by stamp_aibom_inventory:

{
  "provenance": {
    "schema_version": "1.0.0",
    "content_hash": "sha256:8c3a...",
    "generation": "defenseclaw 2.4.1",
    "binary_version": "..."
  },
  "skills": [
    {
      "name": "code-review",
      "version": "1.2.0",
      "source": "~/.claude/skills/code-review",
      "provenance": { "content_hash": "sha256:...", "generation": "..." }
    }
  ],
  "mcp_servers": [...],
  "agents": [...],
  "models": [...],
  "memory": [...]
}

Useful flags:

Where the data lands

Both continuous and on-demand discovery feed the same audit pipeline. Once you've got Observability wired up, the bundled dashboards light up automatically.

Splunk: AI Discovery Inventory

The dashboard reads from the defenseclaw_demo_ai_discovery_events macro and breaks signals down by vendor, category, state, detector, and severity. The recent-events table surfaces signal_id, scan_id, and the human message so an analyst can pivot directly to the source.

Grafana

The local observability stack ships defenseclaw-ai-discovery.json with parallel panels:

• Prometheus counters: defenseclaw_ai_discovery_signals_total{state, category}
• Loki queries: {event_type="ai_discovery"}
• OTel logs: defenseclaw.ai.discovery.*

It cross-links from the overview, runtime, and agent-identity dashboards so you can drill from "block rate spiked" → "which agent" → "when was this agent first discovered."

Privacy and trust model

Discovery touches the most sensitive parts of the host filesystem. DefenseClaw is deliberately conservative:

Use it alongside Registry

Discovery tells you what's there. The Registry tells you what's allowed.

A common production pattern:

Common workflows

See also

• Observability — where the discovery events actually surface
• Splunk — the AI Discovery Inventory dashboard
• Capability Matrix — what hooks each discovered connector exposes
• Setup → Skill Scanner and MCP Scanner — what to do with discovered skills and MCP servers
• Reference → CLI — full flag surface for agent, aibom, registry