Agent discovery
Count your agents before you govern them.
The free assessment turns logs and code you already have into a headcount: how many AI agents are running, how strong the evidence is for each one, and how many have nobody accountable for them. There is nothing to install, nothing tapping your network, and no vendor dashboards to log into.
What you get, free
Four numbers, and what it would cost to fix them.
Agents found
Every candidate the evidence supports, at every strength.
Confirmed
The candidates with evidence that one actually ran, not just that one could.
No owner
Candidates with no accountable human attached. This is usually the number that starts the meeting.
Under governance
How many of them Eniyan already governs. On a first run this is zero, and that gap is the point.
You also get the breakdown by evidence strength, confirmed, likely and possible, so a number you can defend is never mixed with a number you cannot.
And a suggested plan with what governing that headcount would cost at list prices. See the full price list on pricing.
If you are one person
Four steps, about ten minutes of your time, and the count is free.
Start with the tools you already use.
Claude Code, Cursor, GitHub Copilot, Windsurf, an MCP server you wired up one evening, or something you built yourself on an agent framework. Naming them changes what the assessment asks you for, because these agents do not live in a log. They live in the projects on your disk.
Zip a folder. This is the step that finds AI coding tools.
Zip the folder where you keep your projects, or a single project if that is where the interesting work happens, and upload the archive. The scan reads dependency manifests and the configuration and instruction files those tools write into a project. It does not read your source code. If you keep agent configuration in your home folder rather than in a project, zip that too.
Or connect GitHub, knowing what it does and does not cover.
Connecting GitHub covers many repositories at once with nothing to zip. It is read only and it reads root level dependency manifests, never your source code. That finds the agents your code imports, which is the right tool for anything you built. It does not currently read the configuration files AI coding tools leave in a project, so if Claude Code, Cursor, Copilot or Windsurf are what you want counted, upload an archive instead. Doing both is fine and the results merge.
Run the scan and read the four numbers.
Agents found, confirmed, no owner, and under governance. On a first run the last one is zero. The breakdown by evidence strength is free too, so you can see which candidates you would defend and which you would go and check.
Then govern the ones you keep.
Connect the agent, decide which files it may touch and which websites it may reach, keep the approval on anything it spends, and keep the kill switch.
If you are an organization
Five steps, run on telemetry you already have. If you can only get one thing, get step one.
Start with egress logs. This is the source that does not care what you run.
DNS resolver logs, or proxy, secure web gateway or firewall logs, covering the last 30 to 90 days. Anything that calls a model provider has to resolve a hostname first, which is why this one source catches agents that nothing else sees, including agents nobody told you about. Ask whoever runs your network for a CSV export with three things in it: when the request happened, which machine or user made it, and the hostname or URL that was requested. Column names matter more than you would like, so take the exact column list from your checklist after you sign in and hand that to your network team rather than paraphrasing it.
Add your cloud audit logs, one export per platform you actually run on.
- AWS
- CloudTrail, Event history, filtered to the last 90 days, downloaded as JSON. Management and data events if you have both enabled. The command line equivalent works too.
- Google Cloud
- Logging, Logs Explorer, query the last 90 days of audit logs, download as JSON.
- Azure
- Your Azure OpenAI or Cognitive Services resource, Monitoring, Diagnostic settings, export the resource logs for the last 90 days as JSON. Log Analytics works.
These catch model invocations running inside your own cloud accounts, which an office network's egress logs will never see.
Add identity provider sign in logs if you run one. Additive, not a prerequisite.
You do not need an identity provider to do this. Egress and cloud audit logs are the primary sources and an organization with no identity provider is fully in scope. If you do run one, its sign in logs are worth adding, because non interactive and service account sign ins are where machine identities show up. Any OIDC or SAML provider works and the scan detects the export format, so there is no vendor specific step here. One thing worth knowing: if your provider separates ordinary user sign ins from service or application sign ins, export both. The service view is the one people skip and it is where most of the agents nobody claims are living.
Connect or upload your code.
Dependency manifests tell you which of your own teams have built agents into your own applications. Connecting GitHub reads root level dependency manifests across the repositories you select, read only, and never your source code. If you are not on GitHub, upload an archive or just the manifest files. If you suspect MCP or AI coding tools are in use, upload an archive rather than connecting, because those agents live in project configuration rather than in dependencies.
Run the scan, then take the argument to the owners.
You get agents found, confirmed, no owner, and under governance, plus the breakdown by evidence strength. The number that moves a room is usually no owner. On a plan or a trial you also get each candidate by name with its evidence and a report written to be handed to an auditor.
Would rather we ran it with you? We run assessments as an engagement. Talk to us
Answer five questions and see exactly what to collect.
The questionnaire is not loading right now. You can create an account and answer the same questions inside, or read the guide above.
What this cannot see
Absence of findings is not proof of absence.
- A model you host yourself, or traffic resolved over encrypted DNS, can stay out of the logs entirely.
- An agent that lives wholly inside another vendor's product shows up only through the access it was granted.
- A short log window undercounts agents that run rarely.
- A client can misreport what it is.
The assessment installs nothing, watches no network and logs in to no vendor dashboard on your behalf. It reads what you choose to hand it.
From a log it reads which machines reached a model provider and when. From a code archive it reads dependency manifests and the configuration files agent tools leave in a project. It does not read your source code.
Every number the assessment returns is a floor, not a ceiling.
The split
What is free, and what needs a plan.
Free on any account, with no card.
- Starting an assessment. There is no plan gate on it. The assessment is the free product.
- The four numbers, and the breakdown by evidence strength.
- The suggested plan and the cost estimate for that headcount.
On a plan, or on a free trial.
- Each candidate by name, with the evidence behind it.
- The full report, written to be handed to an auditor.
- One click to bring a candidate under governance.
Team includes a 30 day free trial and Personal includes 14. Business and Scale start on the plan. Creating an account takes no card. Starting a trial goes through checkout, so a card is collected at that point and not before.
Start where you belong
Personal account
Any email address works, including a personal one. One seat. $20/mo with 3 agents included, then $2 for each additional agent. There is a 14 day free trial when you are ready, and the assessment is free before that.
Company account
Work email required. Team is $199 a month plus $4 an agent, Business is $499 plus $3, Scale is $999 plus $2, and larger organizations are priced to the engagement. Extra seats are $12 each a month. The assessment is free on any account, before any plan.
If you would rather not run this yourself, we run assessments as an engagement.