{"id":"7d9980cf-f808-4771-911a-24367eb92e37","slug":"northbeams-labs-agentsurface","kind":"mcp","name":"agentsurface","summary":"Local inventory of the AI agent surface on your machine. No account, no network, no upload.","owner":"Northbeams-Labs","repoUrl":"https://github.com/Northbeams-Labs/agentsurface","license":"Apache-2.0","licenseTier":"permissive","trust":"community","stars":1,"match":null,"fewStars":true,"format":"mcp","createdAt":"2026-07-30T14:56:42.000Z","addedAt":"2026-10-21T06:29:06.005Z","logoUrl":"https://avatars.githubusercontent.com/u/311081718?v=4","linkOnly":false,"collection":null,"skillPath":null,"categories":["browser-web","memory-knowledge"],"tags":["ai-agents","browser-extensions","cli","golang","inventory","security"],"runtime":"go","local":true,"cloudCapable":false,"cloudCapability":"unknown","cloudReadyOnPlatform":false,"needsApiKey":false,"reviewed":false,"syncedAt":"2026-10-27T01:35:38.221Z","sample":false,"url":"https://conduits.dev/tools/northbeams-labs-agentsurface","language":"Go","transports":["stdio"],"install":{},"requirements":{"env":[],"upstreamMayCharge":false},"tools":null,"readme":"# agentsurface\n\n**What AI agent machinery is installed on this machine, and who put it there.**\n\n```sh\nbrew install Northbeams-Labs/tap/agentsurface\nagentsurface\n```\n\n\n\nOne real run, unedited. The machine it reads is\n[invented on purpose](docs/demo/README.md), because a recording of a real one\nwould publish somebody's laptop. On a working laptop the counts are higher:\n92 items across 7 categories on the one this was built on.\n\nOne command, and no account, no network call, and nothing uploaded. It reads\nlocal configuration and lists what it finds: model context protocol servers\nacross every client it knows, desktop extensions, plugins, skills, connectors,\nscheduled agent tasks, instruction files, and AI-aware browser extensions. For\neach one it records where it came from, who published it according to its own\nmanifest, and what its declared configuration says it can reach.\n\nThe count is usually higher than expected, and the reason is structural rather\nthan anybody's fault. Agent tooling arrives one approval at a time, from a\nclient install, from a repository that carries its own configuration, from a\nplugin that pulled in others, and nothing on the machine has ever added it up.\n\nIt reads. It does not judge, and it does not act.\n\nOther installs: [Go, signed binaries, and from source](#install).\n\n## What it refuses to do\n\nThese are enforced or settled, not aspirations.\n\n- No network calls of any kind. Not for telemetry, version checks, catalogue\n lookups, crash reports or model calls. CI checks this on every push, and a\n release cannot ship if the check fails. See [PRIVACY.md](PRIVACY.md) and\n [`.github/workflows/no-network.yml`](.github/workflows/no-network.yml).\n- No account, no token, no sign-up, no licence key.\n- No upload. Nothing found on your machine leaves your machine.\n- It never executes anything it finds. It will read the configuration that says\n how an MCP server starts; it will not start it. The compiled binary cannot\n start a process at all, because `os/exec` is on the denied list in the same CI\n check.\n- It never opens browsing data. No history, cookies, local storage, saved\n passwords or profile identities. Extension manifests and native messaging host\n manifests, and nothing else.\n- No risk score, no grade, no letter rating. A score would be a claim we could\n not defend line by line.\n- It writes one file, a local baseline of hashes at\n `~/.config/agentsurface/baseline.json`, and `--no-baseline` switches that off.\n\n## What this does not do\n\nThis section is here rather than at the bottom because it is the part that\ndecides whether the tool is any use to you.\n\n1. It does not tell you whether anything it finds is safe. It is an inventory.\n `not in catalogue` means the catalogue snapshot inside the binary has no\n entry for that item. It does not mean anything is wrong with it.\n2. It does not detect prompt injection, and does not attempt to. Where it\n reports that an instruction file contains a particular kind of wording, that\n is an observation about text.\n3. It reads local files only. A connector attached inside a vendor account, an\n agent running in a cloud workspace, or anything else that leaves nothing on\n this disk is invisible to it. It makes no network calls, so it cannot go and\n ask.\n4. Catalogue matching is only as fresh as the binary. The snapshot ships inside\n the release.\n5. It only finds paths somebody has told it about. There is no registry of agent\n configuration. Every path in the tool came from a vendor's documentation or\n from a real install, and clients change. A path that is wrong finds nothing\n and says nothing, which looks exactly like a clean machine.\n6. It reports what a configuration declares, not what code does. An extension\n that declares nothing can still shell out at runtime.\n7. It cannot see whether a browser extension is switched on, because that state\n lives in browser databases it deliberately does not open.\n\nEvery run prints its own blind spots in a section headed \"What this did not look\nat\", so the limitations are in front of you at the moment they matter rather\nthan in a file you would have to go and find.\n[docs/DETECTIONS.md](docs/DETECTIONS.md) is the standing version, per detector.\n\n## Install\n\nVersion 0.1.0 is released, for macOS and Linux.\n[docs/VERIFY.md](docs/VERIFY.md) is how you check that what you downloaded is\nwhat this repository's release workflow built.\n\n**On Windows**, use the `go install` line below for now. v0.1.0 has no Windows\narchive; the release pipeline now builds and Authenticode signs one, so the next\nrelease will. The detectors have known the Windows paths all along.\n\n**1. Homebrew**\n\n```sh\nbrew install Northbeams-Labs/tap/agentsurface\n```\n\n**2. Go**\n\n```sh\ngo install github.com/Northbeams-Labs/agentsurface/cmd/agentsurface@latest\n```\n\nThis is the one that works on Windows. Requires Go 1.26 or newer. The Go\ntoolchain checks what it downloads against\n`go.sum` and the public checksum database, which proves you got the same bytes\nas everyone else. It does not prove the bytes are safe. Nothing does that except\nreading them.\n\n**3. Signed binaries from GitHub Releases**\n\nDownload the archive for your platform from the\n[releases page](https://github.com/Northbeams-Labs/agentsurface/releases), then\nverify it before you run it. [docs/VERIFY.md](docs/VERIFY.md) has\ncopy-pasteable commands for the checksums, the cosign signature over them, and\nthe build provenance attestation, plus how to rebuild the binary from source and\nconfirm you get the same bytes.\n\nmacOS and Linux archives are published for v0.1.0. The Windows archive arrives\nwith the next release, Authenticode signed; until then `go install` is the\nWindows route.\n\n**From source**\n\n```sh\ngit clone https://github.com/Northbeams-Labs/agentsurface\ncd agentsurface\nmake build # writes ./bin/agentsurface\nmake verify # runs the no-network check yourself\n```\n\n## Use\n\n```sh\nagentsurface # readable summary\nagentsurface --verbose # the same, plus what each item declares\nagentsurface --json # machine-readable\nagentsurface --no-baseline # do not read or write the local drift baseline\nagentsurface --version\n```\n\n## What the output looks like\n\nAn example, with the paths and names changed:\n\n```\nagentsurface v0.1.0 darwin\n4 items found across 3 categories\n\nAI browser extensions (1)\n Example Assistant Google Chrome, example.com, can reach: browser_tabs clipboard, not in catalogue\n ~/Library/Application Support/Google/Chrome/Default/Extensions/abcdefghijklmnop/2.4.1_0/manifest.json\n\nInstruction files (1)\n AGENTS.md agents.md clients, not in catalogue\n ~/code/checkout-service/AGENTS.md\n\nModel context protocol servers (2)\n filesystem Claude Desktop, can reach: shell filesystem\n ~/Library/Application Support/Claude/claude_desktop_config.json\n internal-deploy-tools Cursor, can reach: shell network, not in catalogue\n ~/code/checkout-service/.cursor/mcp.json\n\n6 notes about what these items declare are not shown. Run with -verbose for them.\n\nChanged since the last run (1)\n internal-deploy-tools ~/code/checkout-service/.cursor/mcp.json\n\nCould not read (1)\n browsers: ~/Library/Application Support/Firefox/Profiles permission denied\n\nWhat this did not look at\n browser extensions: classification: extensions are judged on what they declare, not on what their code does\n remote and cloud hosted servers: a server connected inside a vendor account leaves nothing on this disk\n running processes: this reads configuration files only\n\nThis tool inventories what is installed. It does not judge whether any of it is safe.\n```\n\nThe second line of each item is the path, so you can go and read the file\nyourself rather than believing the summary.\n\n`--verbose` prints the notes under each item: the permissions and host access an\nextension declares, the native messaging hosts that name it, why a detector\nreported it at all. On a machine with real agent tooling on it there are\nhundreds of them, which is why the default counts them instead of printing them.\n\n\"Could not read\" is not noise. A permission error means part of the machine was\nnot inventoried, and the run says so instead of quietly returning a smaller\nnumber.\n\n\"What this did not look at\" prints on every run, including the ones that went\nperfectly. It is how you tell \"nothing is installed\" apart from \"nothing was\nlooked at\".\n\n[docs/OUTPUT.md](docs/OUTPUT.md) documents both formats, including every field\nof the JSON.\n\n## Drift\n\nWhen a run finishes, `agentsurface` writes a hash for each item it found to\n`~/.config/agentsurface/baseline.json`. A later run compares against it and\nreports anything whose declared definition changed. That covers the case where a\ntool you already approved was quietly redefined underneath you.\n\nThe file holds hashes and the paths they belong to. It never holds file\ncontents, and it never leaves the machine. Delete it whenever you like, or pass\n`--no-baseline` to neither read nor write it. See [PRIVACY.md](PRIVACY.md).\n\n## What it reads on your machine\n\nLocal configuration belonging to AI agent tooling: client configuration files,\nextension and plugin directories, skill and connector definitions, instruction\nfiles, and browser extension and native messaging host manifests. Plus any\nproject directory you point it at, a few levels down, for configuration a\nrepository carries with it.\n\n[docs/DETECTIONS.md](docs/DETECTIONS.md) lists the paths per detector, and the\ngaps alongside them.\n\n## Documentation\n\n| | |\n|---|---|\n| [docs/DETECTIONS.md](docs/DETECTIONS.md) | What each detector reads, and what it misses |\n| [docs/OUTPUT.md](docs/OUTPUT.md) | The text and JSON output shapes |\n| [docs/VERIFY.md](docs/VERIFY.md) | How to verify a release, and how to reproduce the build |\n| [PRIVACY.md](PRIVACY.md) | What is stored, where, and how to switch it off |\n| [SECURITY.md](SECURITY.md) | Reporting a vulnerability, and what we commit to |\n| [CONTRIBUTING.md](CONTRIBUTING.md) | DCO sign-off, running the tests, adding a detector |\n| [SUPPORT.md](SUPPORT.md) | Where to take a question |\n\n## Contributing\n\nBug reports and missed detections are the most useful thing this project gets.\nContributions use Developer Certificate of Origin sign-off (`git commit -s`),\nand there is no contributor licence agreement. One person reviews.\n[CONTRIBUTING.md](CONTRIBUTING.md) has the detail, including the list of things\nthat are settled decisions rather than open questions.\n\n## Licence\n\nApache License 2.0. See [LICENSE](LICENSE) and [NOTICE](NOTICE). The licence\ngrants no rights to the names or logos; see [TRADEMARK.md](TRADEMARK.md).\n\n---\n\nagentsurface is published by Northbeams Labs, the research imprint of Northbeams.\n\n"}