Find the agents already running on your network.

One self-hosted container: a scanner for Agentic Resource Discovery (ARD), Agent2Agent (A2A) and Model Context Protocol (MCP) metadata inside subnets you authorize, a private registry with the ARD REST API, policy qualification and scheduled scans. Same MIT codebase as this demo. Nothing leaves your tenant.

Operator runbook → Container and compose file

$ agentdossier enterprise selftest
$ agentdossier enterprise preflight enterprise.json
$ agentdossier enterprise plan enterprise.json      # dry run, nothing fetched
$ agentdossier enterprise scan enterprise.json
$ agentdossier serve --catalog build/enterprise/acme-corp/catalog \
      --enterprise-config enterprise.json

The scanner cannot do harm by design

Authorization gate

Starts only with an approver name and a change ticket in the configuration. Both go to the scan report and the audit log.

Allow-list scope

Only listed CIDRs and hosts are reachable. Redirects are re-checked against the scope. Public addresses are always refused; there is no allow-public switch.

Read-only probes

HTTP GET of the standards' well-known documents and, optionally, the MCP list methods. No tool calls, no A2A messages, no credential guessing, no port sweeps.

Throttled

4 requests/s per host, 16 concurrent hosts, 2 MB response cap, 8 s timeout by default. Give SecOps the scanner IP and window.

Secrets stay out

Auth headers come from environment variables named in the config and are never written to the file, the catalog or the report.

Tenant-private

Records carry scope=private and the tenant ID and live only in your catalog. Runs air-gapped; the public demo never scans anyone.

Eight steps to a private inventory

01 Authorize Written approval of subnets, hosts, ports and window, plus a change ticket. The scanner records approver and ticket. Done when: approved change ticket exists

02 Place the scanner inside the network Linux VM, jump host or Kubernetes job in the same segment. No inbound ports needed; runs air-gapped. Avoid laptops on VPN. Done when: host reaches a sample target

03 Install Pull the image into your internal registry or install the Python package (3.11+). Verify the checksum. Done when: agentdossier --version runs

04 Open the network path Firewall rules to targets on the configured ports. Add internal ranges to NO_PROXY. Tell SecOps the scanner IP and window. Done when: preflight passes

05 Configure Write enterprise.json. Trust the internal CA via tls.ca_bundle. Secrets by environment variable only. Leave the MCP handshake off until service owners agree. Done when: config validates

06 Test The self-test must find the bundled loopback fixtures. The plan (dry run) lists every target and sends nothing. Pilot on one small subnet. Done when: zero out-of-scope requests

07 Run and protect results Outputs a private catalog, scan-report.json, raw probe snapshots and a generated ard.json. The catalog maps internal endpoints: store it restricted. Done when: catalog behind SSO

08 Operate Weekly schedule in the config, rotate the token, review the audit log. Ask teams to publish agent-card.json, ard.json or an MCP server card. Done when: scheduled scan running

enterprise.json

Validates against the published schema. Authorization is part of the file; secrets are not. The scope is the only address space the scanner can reach.

Three ways to run it

CLI + local viewerThe scanner writes a catalog; open its index.json in the private catalog viewer. The file stays in the browser. Quick inventories, pilots.

Self-hosted registryThe container serves the UI, the ARD REST API, POST /qualify, scheduled scans and an MCP wrapper. Production, people and orchestrators.

Publish internallyServe the generated ard.json on an internal domain so other registries and agents can discover what you found.

{
  "tenant": "acme-corp",
  "authorized_by": "J. Smith, CISO office",
  "ticket": "CHG-10432",
  "scope": { "allow_cidrs": ["10.20.0.0/16"],
             "allow_hosts": ["agents.corp.acme.com"] },
  "targets": { "cidrs": ["10.20.4.0/24"],
               "hosts": ["claims-agent.corp.acme.com"],
               "dns_domains": ["corp.acme.com"],
               "registries": ["https://agent-registry.corp.acme.com"] },
  "ports": [443, 8080],
  "probes": { "ard": true, "a2a": true,
              "mcp_server_card": true, "mcp_handshake": false },
  "limits": { "requests_per_host_per_sec": 4,
              "concurrency": 16, "timeout_sec": 8 },
  "auth": { "headers_from_env": { "Authorization": "AGENTREG_INTERNAL_TOKEN" } },
  "tls": { "ca_bundle": "/etc/ssl/corp-root-ca.pem" },
  "schedule": { "cron": "0 6 * * 1" }
}

From discoveredto approved and monitored.

Policy templates mark every result Eligible, Needs review, Disallowed or Unknown with the rule-by-rule reason, on the page and through POST /qualify for your orchestrators. Templates ship for healthcare, bank, insurer, startup and government. Scheduled scans, scan history, a hash-chained audit trail, and a decision workflow with per-role sign-offs are built in — and a decision can carry require_trace_tier, so an agent cannot be approved until it has actually been watched under attack, in your tenant or in the public record.

Read the runbook → Policy templates