Four passes, because one is never enough
A dependency scan finds the SDK and stops. It misses the agent configured through a dotfile, the model named in a string literal, and the agent that pushed a commit and left nothing else behind.
Provider and tool environment variable names are recorded. Values are never read, so an inventory can be produced without touching a credential.
Tool configuration, instruction files, ignore files, skills, hooks, plugins, steering files, memory, prompts, agent definitions, custom commands and marketplace manifests.
Model names extracted by anchoring on the SDK parameter, so a model released after the scanner was built is still captured.
Author and committer identity and message conventions, which is the only way to find an agent that touched the repository and left nothing behind.
An inference server is an AI asset
The AI in an estate is not only the code that calls an API. Container, Compose, Kubernetes and Helm manifests are read for serving and inference images, for custom resources that embed a pod template so a model served by an operator is not invisible, for GPU and accelerator resource requests, and for volume mounts classified by what they carry.
CycloneDX, validated against the schema
Tools become applications, SDKs become libraries, and models become machine learning model components with a model card. It is a standard document, so it goes wherever your SBOM already goes.
Environment variable values are never read, and prompts, conversations and completions are not collected. The catalogue that drives detection is embedded and can be replaced or extended at runtime, so a tool your organisation built in house can be recognised too.
A static inventory pairs with runtime observation: the AI firewall records the models an estate is configured to reach. Inference images inside a deployment are also read by container scanning, and the cryptography beside them by the cryptography bill of materials.