How one admin inventories AI agents and MCP servers on endpoints with a PowerShell script
stockandcrypto · reddit · 2026-09-13
An MSP admin shares a practical workflow for inventorying AI tools users install on endpoints—Claude Code, Cursor, Codex, Windsurf, MCP servers, Copilot/ChatGPT extensions—which run commands as the user and often store plaintext API keys.
Key points:
- RMM runs as SYSTEM, which has no agents; you must scan each real user profile including AppData.
- Most tools need Node.js (winget install OpenJS.NodeJS.LTS).
- He runs MIT-licensed geiger-scan via npx per profile, outputting JSON inventories; exit code 2 flags anything that can execute code or holds a credential. After a first review, switch to --diff mode against a baseline JSON so only new or escalated findings alarm, like a lockfile.
- Detects MCP servers/hooks across major IDEs and CLIs (Claude Desktop, Cursor, Windsurf, VS Code, Cline, Zed, JetBrains), agent CLIs (Codex, Aider, Goose), browser extensions with permissions, and AI browsers like Comet, Dia, Atlas.
- Limitations: config-only (no runtime), no container/WSL coverage, can't judge maliciousness. He asks whether others gate this at onboarding or just report.
More from coding & agent
- Chromium source ships an .agent/ folder with agent instructions and skills — HankYeomans · 2026-09-13
- AI FDEs Must Turn Production Failures into Evals, Release Gates, and Evidence — ryanorban · 2026-09-13
- Dev Open-Sources Two ComfyUI Workflows for Per-Slot Reference Control in Nano Banana Pro — Cute-Appointment6874 · 2026-09-13
- Three qualitative benchmarks for testing if AI agents can design systems — tianyin_xu · 2026-09-13
- Simulating famous thinkers beyond 'act like X': grounding personas in documented beliefs — haybreaker · 2026-09-13
- Designer uses GPT-6 Astra with print-and-fit feedback loop to make a perfect 3D-printed enclosure — OpenAIDevs · 2026-09-13