Step 2 10 min

Run a Scan

Trigger a discovery scan and see discovered AI agents appear in your inventory.

Trigger a Shadow AI Scan

A scan queries your connected infrastructure (AWS, GCP, K8s, etc.) for AI agents. Each discovered agent gets classified as governed (already registered), shadow (not registered), or orphaned (was registered, now disconnected).

Run Scantypescript
const response = await fetch('https://api.mosscomputing.com/v1/shadow-ai/scan', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer ' + access_token,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    sources: ['aws', 'gcp', 'kubernetes', 'docker', 'cicd'],
  }),
});

const scan = await response.json();
Response200 OK
{
  "scan_id": "scan_abc123",
  "status": "completed",
  "discovered_count": 7,
  "summary": {
    "governed": 2,
    "shadow": 4,
    "orphaned": 1
  }
}

View the Agent Inventory

The inventory endpoint returns all discovered agents grouped by state.

Get Inventorytypescript
const inventory = await fetch('https://api.mosscomputing.com/v1/agents/inventory', {
  headers: { 'Authorization': 'Bearer ' + access_token },
}).then(r => r.json());

console.log('Governed:', inventory.governed.length);
console.log('Shadow:', inventory.shadow.length);
console.log('Orphaned:', inventory.orphaned.length);
Response200 OK
{
  "governed": [
    { "id": "...", "name": "Customer Support Bot", "source": "manual" }
  ],
  "shadow": [
    { "id": "...", "name": "lambda-ai-summary", "source": "aws", "vendor": "openai" },
    { "id": "...", "name": "review-bot", "source": "cicd", "vendor": "anthropic" },
    { "id": "...", "name": "vertex-chat", "source": "gcp", "vendor": "google" },
    { "id": "...", "name": "doc-summarizer", "source": "kubernetes", "vendor": "local" }
  ],
  "orphaned": [
    { "id": "...", "name": "old-trading-bot", "source": "manual" }
  ],
  "counts": { "governed": 1, "shadow": 4, "orphaned": 1, "total": 6 }
}

4 shadow agents found!

These AI agents are running in your infrastructure but are not governed by MOSS. They have no policies, no signing, and no audit trail. You need to register them.