You can't govern the agents you can't list.
For the security team — the master roster of every AI agent in your environment.
Agents don't register in your asset inventory. They run inside node, python, and shell — some monitored, some forgotten, some completely dark. The roster is the first thing that's wrong, and if it's wrong, every other view is wrong.
The list nobody actually has.
You can't put a number on your agent exposure because no system holds the full set — let alone who owns each one or whether it's under control.
They never registered
Agents run inside ordinary processes. They don't show up in your CMDB, your EDR asset list, or your identity provider.
Orphaned and forgotten
An agent someone spun up for a project six months ago is still running, still credentialed, and no one remembers it exists.
Governed or dark?
You can't tell a controlled, monitored agent from one that's installed but reporting nothing — so you can't trust any coverage claim.
One roster, ranked by risk.
Discover every agent
Process signatures, file fingerprints, and embedded-runtime detection surface every agent — including the ones installed but not reporting telemetry.
Label its lifecycle
Active, stale, forgotten, decommissioned, or shadow — each agent carries a state, so the orphans and the dark ones rise to the top.
Rank by risk and drill in
The roster sorts by danger and flags compound risk — a dangerous agent that's also ungoverned — and links straight to each agent's profile.
Start with a roster you can trust.
Every agent, every owner, every lifecycle state — ranked by the risk that matters.