Platform/Discover
VIJIL DISCOVER · AGENT INVENTORY

Find every agent running in your enterprise

Shadow agents are already in your cloud, endpoints, and repos. Discover scans five surfaces, fingerprints each agent, and lands it in one registry your auditor can triage.

Start for free Learn more
$ vijil discover --github-org acme
Discover — scan dashboard
DISCOVER · SCAN COMPLETE
agents found23
unregistered3 FLAGGED
attested (SPIFFE)20 ✓
5 surfaces scannedILLUSTRATIVE
THE INVENTORY PROBLEM

You cannot govern a population you cannot enumerate

Agents arrive through five different doors — a developer’s repo, a cloud function, an endpoint, a SaaS tool that shipped a new feature, a partner integration — and none of them files paperwork. Every one nobody knows about is feral: running in your estate, holding credentials, answering to no one. The list your auditor asks for is a spreadsheet somebody stopped updating.

Shadow

Agents ship inside SaaS features and cloud functions. No procurement event, no ticket, no entry on any list.

Orphaned credentials

An agent nobody owns still holds an API key. Rotating it breaks something, and nobody knows what.

Unprovable scope

Every claim about your agent estate — count, risk, compliance — rests on a list that was never complete.

HOW IT WORKS

Five surfaces in, one registry out

Cloud VPC AWS · GCP · Azure On-prem Kubernetes · VMware Endpoints Mac · Windows · Linux Browser model use in the browser Source code GitHub repositories DISCOVER scanners + fingerprinting always on · continuous ENRICHED AGENT RECORD identity · model · owner permissions · risk attested — SPIFFE X.509 SVID stored · searchable · auditable auditor triage → verify Cloud VPCAWS · GCP · Azure On-premK8s · VMware EndpointsMac · Win · Linux BrowserLLM use Source codeGitHub repos DISCOVER scanners + fingerprinting always on · continuous ENRICHED AGENT RECORD identity · model · owner permissions · risk ✓ attested — SPIFFE X.509 SVID stored · searchable · auditable auditor · triage · → verify
Commissioned and found agents take the same path — the ones nobody told you about land in the same registry as your own builds.
Read the Discover docs →
FROM SHADOW TO ATTESTED

Every agent gets an identity

1
Scan
Five surfaces, continuously — cloud, on-prem, endpoints, browser, source code.
2
Fingerprint
Identify each workload as an agent: its model, tools, and reach.
3
Register
Land it in one registry with an enriched record and a named owner.
4
Attest
Issue cryptographic identity — SPIFFE / SPIRE X.509 SVIDs, not just IAM.
CNCF-STANDARDSPIFFE / SPIRE· EPHEMERAL CREDENTIALSvault-pulled, auto-rotated, never persisted· IN YOUR NETWORKmetadata only leaves — never your data
SPIFFE identity explainer →
INSTALL & RUN

One scan, one registry

Point Discover at your org. It scans five surfaces, fingerprints what it finds, and lands every agent in one registry — then mints an identity for each, so the rest of the lifecycle has something to attach evidence to.

discover
$ pip install vijil-sdk# CLI + SDK
$ vijil discover --github-org acme# scan five surfaces
$ vijil register github.com/acme/agent# mint a SPIFFE identity
IN YOUR NETWORK
metadata only leaves — never your data
EPHEMERAL CREDENTIALS
vault-pulled, auto-rotated, never persisted
CNCF-STANDARD
SPIFFE / SPIRE identity, not a vendor token
PROOF
You can’t verify what you can’t see. Discover is the single door into the lifecycle — an inventory the risk owner trusts because nothing routes around it.
Every agent and the tools it calls are attested — cryptographic identity, not just IAM
5
surfaces scanned continuously
X.509
SPIFFE SVID issued per agent and tool
How attestation works →
WHERE IT FITS
spec YOUR INPUT discover DISCOVER verify DIAMOND deploy YOUR CI/CD defend DOME evolve DARWIN what production teaches amends the spec Dashed steps are yours, not ours
Discover is the single door into the Trusted Agent Lifecycle: discover inventories what’s actually running; register admits verified agents to the production registry. Nothing reaches Diamond unseen, and nothing unverified reaches production.
  Vijil Diamond   Vijil Dome   Vijil Darwin

Find your shadow agents today

Free tier, no sales call. Point Discover at your org and get a complete agent inventory.

Start for free