Skip to main content
Inventory answers one question for Enterprise admins: what AI is in use in this workspace, and is it going through Passport? It has two tabs:
  • Through Passport: every agent connected to Passport, who uses it, and whether it is idle or out of date.
  • Outside Passport: MCP connections people configured directly in supported local agents, found by passport discover scans.
Your own agents stay on Agents, the same page every member sees.

​
Agents through Passport

Open Inventory. The table has one row per agent: the people using it, its connections, the newest version in use, and when it was last active. Choose a row to see each install, its owner, where it runs, and its version.
  • Idle agents haven’t been used in 30+ days. Revoke the ones you don’t recognize.
  • Out of date marks installs two or more versions behind the newest version of the same software in use. Passport CLI and every Desktop compatibility connection run the same Passport bridge, so they share one version line; other agents compare within their own versions.
  • Search by person, agent, or device to find one install.
Revoking an install cuts its access right away. Its owner must reconnect it. The list shows real observed connections; opening setup instructions alone does not add a row. When people in the workspace run Passport Desktop, its rollout summary appears above the table.

​
Connections outside Passport

Open Inventory → Outside Passport. Each finding becomes a clear decision:
  • approve the direct connection;
  • ask the owner to move it behind Passport;
  • allow it temporarily; or
  • ask the owner to remove it.
Scans report configuration, not usage. A finding means a connection was present during a scan. It does not prove that anyone used it.

​
Review the action queue

On Outside Passport, the action queue appears first and groups the same MCP found in several agents into one decision. For each item, review:
  • who owns it and how they described its purpose;
  • which supported agents contain it;
  • whether it could be routed through Passport; and
  • the current admin decision.
Members can describe a connection as Work, Evaluating, Personal, or Not needed. This is context they provide, not a conclusion Passport draws from their activity.

​
How scans reach Passport

Every finding comes from the Passport CLI. On a member’s computer, run:
The command is headless and needs no desktop app, so it fits an onboarding script, a login hook, or a scheduled MDM job. It scans supported global configuration for Claude Desktop, Claude Code, Cursor, VS Code, and Codex, submits the limited report described below, and uses the signed-in Passport CLI profile on that computer. Daily is a good cadence, because a source that has not reported for seven days stops counting as current coverage. Managed policy has three responses: Your endpoint-management system decides what to do with exit code 5, such as notify, quarantine, or start its own remediation. Passport does not silently edit a managed device.
Passport Desktop no longer scans local agent configuration. Desktop is sign-in, connection repair, apps, activity, and approvals; passport discover is the only source of outside-Passport findings.

​
What happens on a member’s computer

passport discover only reads supported configuration files, and Passport never edits them. A Route through Passport or Remove decision is a request to the owner, who makes the change in the agent that holds it; the next scan confirms the result.

​
Coverage and scan policy

Outside Passport says how many people’s computers reported a scan this week. Choose See who’s missing to list the people whose computers haven’t sent a scan, whose last scan is over a week old, or whose last scan couldn’t read agent settings. Project-level configuration, hosted agents, and computers that never run passport discover are outside coverage. Choose Scan policy in the page header to switch between:
  • Personal (opt-in): each member decides whether their computer reports scans.
  • Managed work computers: administrators run passport discover through device management (MDM) or an onboarding script.
Sources older than seven days stop counting as current coverage, but their last findings remain visible.

​
What scans do not upload

A scan reports the authenticated member and installation, installation label, agent, safe MCP name, transport type, remote hostname or safe executable class, whether the settings are protected, and scan status and time. It does not upload configuration paths, commands, arguments, environment variables, headers, tokens, endpoint paths, query strings, prompts, files, tool inputs or outputs, or network traffic. A full remote address leaves the computer only after the member reviews and confirms a move. Failed or permission-denied scans update coverage but do not erase a finding. Passport needs two successful scans without the entry before marking it no longer found. If a removed entry appears again later, Inventory reopens it for review.

​
Where this used to be

Inventory replaces Discover and the Agents → Workspace agents tab. Old links open the matching Inventory view.