Skip to the content

AI agent inventory and shadow AI detection

Every agent, app, tool server and model route, who answers for each, and what nobody registered.

In the adminFleet

The fleet is Quilzo's inventory of AI: its own agents, connected apps, MCP tool servers, model routes, and other vendors' agents registered by their A2A cards, with a map of who called what drawn from the signed audit log.

Read the map

The Fleet screen: a map of agents, apps and tool servers, and a table of every agent with its sponsor, standing, autonomy and spend — The map is drawn from the log, so it shows what happened rather than what was declared.

quilzo fleet --days 30

Register other vendors' agents

quilzo fleet add https://agents.example.com/.well-known/agent-card.json --name helpdesk-bot
quilzo fleet check
quilzo fleet remove helpdesk-bot

Quilzo reads the card when you register it and again on fleet check; a card that changed is a posture finding (fleet.card-changed).

Find shadow AI

AI services reached directly, not through Quilzo, are found in the security events you already collect: destinations in proxy and DNS logs, app grants in your identity provider, browser extensions, and connections your own agents' programs made. Lookalike hosts are not matched.

quilzo fleet shadow --days 7

Direct use becomes the posture finding ai.shadow-use, and counts in the AI evidence.

Next