agentdiscover 2.9.2__tar.gz → 2.9.3__tar.gz

{agentdiscover-2.9.2 → agentdiscover-2.9.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentdiscover
-Version: 2.9.2
+Version: 2.9.3
 Summary: Discover every AI agent in your infrastructure. 5-layer detection: static analysis, network monitoring, eBPF/Kubernetes runtime, endpoint, and cloud audit (CloudTrail). Company-level correlation. AIBOM export. MCP server detection.
 Project-URL: Homepage, https://defendai.ai
 Project-URL: Documentation, https://github.com/Defend-AI-Tech-Inc/agent-discover-scanner/blob/main/README.md

{agentdiscover-2.9.2 → agentdiscover-2.9.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "agentdiscover"
-version = "2.9.2"
+version = "2.9.3"
 description = "Discover every AI agent in your infrastructure. 5-layer detection: static analysis, network monitoring, eBPF/Kubernetes runtime, endpoint, and cloud audit (CloudTrail). Company-level correlation. AIBOM export. MCP server detection."
 readme = "README.md"
 requires-python = ">=3.10"

{agentdiscover-2.9.2 → agentdiscover-2.9.3}/src/agent_discover_scanner/correlator.py

@@ -211,12 +211,24 @@ def _populate_saas_and_risk_flags(
 
     risk_flags = []
     detected = saas.get("detected", [])
+    is_shadow = item.classification == "shadow_ai_usage"
+
     if item.classification == "ghost" and detected:
         risk_flags.append("critical_ghost")
-    if saas.get("has_cloud_provider"):
+
+    # cloud_credentials_present and database_credentials_present require evidence of
+    # actual credentials (API keys, env vars, .env files) — not just network connections
+    # to cloud services.  Shadow AI agents are browsers / desktop apps: their network
+    # traffic to Azure/GCP/AWS is normal browsing, not credential usage.  Only flag
+    # when credential_files_found exist, or when the agent is code-backed (non-shadow).
+    has_actual_cred_evidence = bool(
+        saas.get("credential_files_found") or (not is_shadow)
+    )
+    if saas.get("has_cloud_provider") and has_actual_cred_evidence:
         risk_flags.append("cloud_credentials_present")
-    if saas.get("has_database_access"):
+    if saas.get("has_database_access") and has_actual_cred_evidence:
         risk_flags.append("database_credentials_present")
+
     if saas.get("has_external_api_calls") and item.classification == "unknown":
         risk_flags.append("unverified_saas_access")
     item.risk_flags = risk_flags

{agentdiscover-2.9.2 → agentdiscover-2.9.3}/src/agent_discover_scanner/platform.py

@@ -427,13 +427,22 @@ def format_agents_for_upload(
 
             agents.append(
                 {
+                    # Identity / display
+                    "agent_id": item.get("agent_id"),
                     "name": name,
                     "framework": framework,
                     "agent_type": agent_type,
                     "confidence_score": confidence_score,
+                    "risk_level": item.get("risk_level"),
+                    # Machine context
                     "hostname": _hostname,
                     "username": _username,
                     "os": _os,
+                    # Runtime context
+                    "process_name": item.get("process_name"),
+                    "code_file": item.get("code_file"),
+                    "last_seen": item.get("last_seen"),
+                    # SaaS / MCP blast radius
                     "saas_connections": metadata.get("saas_connections") or {},
                     "mcp_connections": metadata.get("mcp_connections") or {},
                     # L5 enrichment promoted to top-level (server schema v2.8.0)
@@ -660,7 +669,20 @@ def upload_scan_results(
                 print(f"  Models identified:   {len(_ca_summary['models_used'])}")
             if _net_summary.get("total_connections"):
                 print(f"  Network connections: {_net_summary['total_connections']}")
-            print("  Dashboard: https://discover.defendai.ai/dashboard/agent_inventory")
+            # Prefer tenant-specific dashboard URL from server response; fall back
+            # to a generic discover URL if the server doesn't return one.
+            _dashboard_url = "https://discover.defendai.ai/dashboard/agent_inventory"
+            try:
+                _resp_json = response.json()
+                if isinstance(_resp_json, dict):
+                    _dashboard_url = (
+                        _resp_json.get("dashboard_url")
+                        or _resp_json.get("tenant_dashboard_url")
+                        or _dashboard_url
+                    )
+            except Exception:
+                pass
+            print(f"  Dashboard: {_dashboard_url}")
             return True
 
         reason = f"HTTP {response.status_code}"