Agent discovery & inventory
Capability inside Checkmarx One that inventories AI components by scanning source code and configuration files in connected repositories, cataloguing models, agents, MCP servers, AI libraries and SDKs on every commit, then emitting an AI-BOM and enforcing policy in pull requests and CI/CD. Scope is the software pipeline, not employee tool usage.
commercial · generally available · Research snapshot 2026-09-06
Visit the official product source ↗Agent discovery & inventory · AI risk & compliance management · Model lifecycle & governance
Useful conversation with: AppSec manager, CISO, Compliance lead.
Show me an AI-BOM generated from one of our repositories listing every detected model, agent and MCP server with the file and commit where it was found.
Support labels reflect the supplied research. Documentation and vendor claims are not independent product tests. “Not established” means the researcher did not find support; it does not prove a capability is absent.
Vendor claim
Inventories models, agents, MCP servers, AI libraries and SDKs directly from source code and configuration files across repositories, refreshed on every commit.
Limit: Product page; language and framework coverage of the detection engine is not enumerated.
Documented by provider
Checkmarx announced general availability of Checkmarx AI Inventory within Checkmarx One on 23 June 2026, describing deterministic detection and AI-BOM generation for discovered components.
Limit: Press release does not detail supported languages, agent frameworks, or false-positive handling.
Vendor claim
Policies on approved models, agents, MCP servers and SDKs can be enforced in pull requests and CI/CD pipelines, flagging or blocking unapproved components.
Limit: No documentation reviewed on policy syntax or enforcement points.
Listing does not imply partnership, supplier status, a working DutyGraph integration, or a compliance certification.
Suggest a correction