> ## Documentation Index
> Fetch the complete documentation index at: https://docs.passportmcp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Find connections outside Passport

> Find direct MCP connections, understand why they exist, and bring them under workspace control.

Discover helps Enterprise admins find MCP connections that people configured directly in supported local AI clients.

Each finding becomes a clear decision:

* approve the direct connection;
* ask the owner to move it behind Passport;
* allow it temporarily; or
* ask the owner to remove it.

<Warning>
  Discover reports configuration, not usage. A finding means a connection was present during a scan. It does not prove that anyone used it.
</Warning>

## Review the action queue

Open **Discover**. The action queue appears first and groups the same MCP found in several clients into one decision.

For each item, review:

* who owns it and how they described its purpose;
* which supported clients contain it;
* whether Passport can guide a safe move; and
* the current admin decision.

Members can describe a connection as **Work**, **Evaluating**, **Personal**, or **Not needed**. This is context they provide, not a conclusion Passport draws from their activity.

## What happens on a member's computer

Passport Desktop scans only after the member enables Discover.

For a supported remote connection, Desktop can guide a move behind Passport. Before changing anything, it checks that the reviewed entry, the governed replacement, and the client's app selection still match. It creates a backup, changes only the reviewed entry, and verifies the result.

If an admin asks for removal, the member can use the same reviewed backup-and-verify flow without creating a replacement. Passport never silently edits the file.

## Coverage and Fleet policy

The Discover page shows reporting computers and supported client sources. Project-level configuration, hosted clients, and computers without Passport Desktop discovery or the managed scanner are outside coverage.

Choose **Fleet policy** in the page header to switch between:

* **Personal · opt-in** — each member decides whether Desktop scans.
* **Managed fleet** — administrators deploy the scanner through endpoint management.

Sources older than seven days stop counting as current coverage, but their last findings remain visible.

## Managed scanner

For a managed Windows, Linux, or macOS fleet, schedule:

```sh theme={null}
passport discover
```

The command scans supported global configuration for Claude Desktop, Claude Code, Cursor, VS Code, and Codex, then submits the same limited report as Desktop. It uses the signed-in Passport CLI profile on that computer.

Managed policy has three responses:

| Response                  | Managed scanner behavior                                                             |
| ------------------------- | ------------------------------------------------------------------------------------ |
| Observe only              | Report findings and always exit successfully.                                        |
| Require Passport route    | Exit `5` while any active direct connection lacks an explicit approval or exception. |
| Fail denied managed scans | Exit `5` when an active direct connection has an admin decision of **Remove**.       |

Your endpoint-management system decides what to do with exit code `5`, such as notify, quarantine, or start its own remediation. Passport does not silently edit a managed device.

<Note>
  Managed mode does not turn on Desktop scanning. Use `passport discover` for administrator-deployed reporting; Desktop remains controlled by the member.
</Note>

## What Discover does not upload

Discover reports the authenticated member and installation, installation label, client, safe MCP name, transport type, remote hostname or safe executable class, whether the settings are protected, and scan status and time.

It does **not** upload configuration paths, commands, arguments, environment variables, headers, tokens, endpoint paths, query strings, prompts, files, tool inputs or outputs, or network traffic. A full remote address leaves the computer only after the member reviews and confirms a move.

Failed or permission-denied scans update coverage but do not erase a finding. Passport needs two successful scans without the entry before marking it no longer found.

If a removed entry appears again later, Discover reopens it for review.