Discover Shadow AI

Shadow AI is the agents and MCP servers running in your enterprise that nobody registered or approved. Discovery surfaces them so you can govern, approve, or shut them down.

What counts as shadow#

• An agent with discovered: true (found by a scanner or integration, not deliberately registered) or in lifecycleState: DISCOVERED.
• An MCP server with discovered: true or approvalStatus: PENDING.

Discovered agents carry a trust penalty — they were found, not governed.

1. See the shadow estate#

The overview endpoint quantifies it:

curl -s "https://your-company.authspoke.com/api/v1/ai/overview" -H "Authorization: Bearer $TOKEN" \
  | jq '{shadowAgents, shadowMcpServers, pendingMcpApprovals}'

List the actual records by filtering the inventories:

# Shadow agents
curl -s "https://your-company.authspoke.com/api/v1/ai/agents" -H "Authorization: Bearer $TOKEN" \
  | jq '[.[] | select(.discovered == true)] | .[] | {agentId, name, owner, riskScore}'

# Unapproved MCP servers
curl -s "https://your-company.authspoke.com/api/v1/ai/mcp-servers" -H "Authorization: Bearer $TOKEN" \
  | jq '[.[] | select(.approvalStatus == "PENDING" or .discovered == true)] | .[] | {mcpId, name, trustLevel}'

2. Govern a discovered agent#

Bringing it under governance is a lifecycle promotion — clear the discovered flag and move it out of DISCOVERED:

curl -X PUT "https://your-company.authspoke.com/api/v1/ai/agents/$AGENT_ID" \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{ "name":"unknown-scraper", "owner":"[email protected]", "lifecycleState":"REGISTERED", "discovered":false }'

Trust rises as soon as it has an owner, a stronger authMethod, and an approved lifecycle — the scores recompute on every update.

3. Approve or reject a discovered MCP server#

# Approve + raise trust
curl -X PUT "https://your-company.authspoke.com/api/v1/ai/mcp-servers/$MCP_ID" \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{ "name":"zapier-mcp", "approvalStatus":"APPROVED", "trustLevel":"INTERNAL" }'

# …or reject it outright
curl -X PUT "https://your-company.authspoke.com/api/v1/ai/mcp-servers/$MCP_ID" \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{ "name":"zapier-mcp", "approvalStatus":"REJECTED", "trustLevel":"UNTRUSTED" }'

Once approved with a non-UNTRUSTED trust level, a server drops out of the shadow view and counts toward your governed estate.

Console#

Enterprise AI → Discovery lists ungoverned agents and unapproved MCP servers with one-click Govern / Approve actions.

See AI Discovery for the concept and Risk & Trust for how discovery affects scores.