MCP / agent inventory
Which coding agents and MCP servers are configured, including the ones nobody approved. Names and counts, never arguments.
What a row is
Collectors emit event_type=inventory with configured_mcp_servers[] when the set of servers in a tool’s config files changes. Each entry is exactly:
| Field | Meaning |
|---|---|
name | Server identifier as configured (e.g. github). Cleartext on purpose: it names infrastructure and is matched against an allowlist. Max 128 characters. |
scope | user = tool-global / user-level config. project = project or workspace-level config. |
That is the whole object. additionalProperties: false: a command, args, URL, or env value makes ingest reject the event.
Live calls use event_type=tool_use / tool_calls[] (tool_name, optional mcp_server, action_class, count, duration_ms). Still names and counts.
Approved vs unapproved
| Allowlist | What you see |
|---|---|
| Empty (default) | Discovery mode. Every configured server and every MCP call is unapproved and fires an observe finding so you can inventory before locking a list. |
| Non-empty | Servers on the list are approved. Anything else is unapproved. |
Unapproved is a status, not a block. The platform engine does not deny MCP calls. A few endpoint collectors can deny an unapproved server locally when a managed enforcement.json is in mode: enforce.
What this is not
- Not an inline MCP gateway. AIM does not mediate or inspect arguments.
- Not a prompt or tool-arg collector. There is no “show me the call” path.
- Not complete for every vendor. Grok Build currently has no local MCP config surface, so inventory rows stay unsupported there until a metadata-only surface exists.
Missing a tool or MCP server? Open an inventory-gap issue. Do not paste prompts, args, URLs, or env. Markdown: inventory.md.