--- title: "ListAgenticInventory lists agentic inventory records." method: GET path: "/v1/namespaces/{tenant_meta.namespace}/agentic-inventory" tags: ["AgenticInventoryService"] --- # ListAgenticInventory lists agentic inventory records. `GET /v1/namespaces/{tenant_meta.namespace}/agentic-inventory` ## Request - Base URL: `https://api.endorlabs.com` - URL: `https://api.endorlabs.com/v1/namespaces/{tenant_meta.namespace}/agentic-inventory` - Auth: none declared ## Path parameters - `tenant_meta.namespace` string, required ## Query parameters - `list_parameters.filter` string - `list_parameters.page_token` integer - `list_parameters.page_size` integer - `list_parameters.action` string - `list_parameters.mask` string - `list_parameters.traverse` boolean - `list_parameters.sort.path` string - `list_parameters.sort.order` 'SORT_ENTRY_ORDER_UNSPECIFIED' | 'SORT_ENTRY_ORDER_ASC' | 'SORT_ENTRY_ORDER_DESC' - `list_parameters.count` boolean - `list_parameters.group.aggregation_paths` string - `list_parameters.group.show_aggregation_uuids` boolean - `list_parameters.group.unique_count_paths` string - `list_parameters.group.unique_value_paths` string - `list_parameters.ci_run_uuid` string - `list_parameters.page_id` string - `list_parameters.group_by_time.aggregation_paths` string - `list_parameters.group_by_time.show_aggregation_uuids` boolean - `list_parameters.group_by_time.interval` 'GROUP_BY_TIME_INTERVAL_UNSPECIFIED' | 'GROUP_BY_TIME_INTERVAL_YEAR' | 'GROUP_BY_TIME_INTERVAL_QUARTER' | 'GROUP_BY_TIME_INTERVAL_MONTH' | 'GROUP_BY_TIME_INTERVAL_WEEK' | 'GROUP_BY_TIME_INTERVAL_DAY' | 'GROUP_BY_TIME_INTERVAL_HOUR' | 'GROUP_BY_TIME_INTERVAL_MINUTE' | 'GROUP_BY_TIME_INTERVAL_SECOND' - `list_parameters.group_by_time.group_size` integer - `list_parameters.group_by_time.start_time` string, date-time - `list_parameters.group_by_time.end_time` string, date-time - `list_parameters.group_by_time.mode` string - `list_parameters.group_by_time.aggregation_value_field` string - `list_parameters.group_by_time.aggregation_operator` string - `list_parameters.disable_pagination` boolean ## Response `200` A successful response. - V1ListAgenticInventoryResponse: Response to list agentic inventory records. - `count_response` V1CountResponse: Response to a list count request. - `count` integer: Number of objects matching the given list parameters. - `group_response` V1GroupResponse: Response to a list group request. - `groups` object: Map indexed by values of the fields specified in aggregation_paths, for example, {"[{"key":"meta.kind","value":"Project"}]": { "aggregation_count": { "count": 1649 } } }. - `list` V1ListAgenticInventoryResponseList - `objects` V1AgenticInventory[] - `meta` V1Meta, required: Common fields for all Endor Labs resources. - `annotations` object: Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time: Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string: Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string: Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData: IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float: search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time: Time that the resource will be deleted. - `kind` string: Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required: Resource name. Must be 63 characters or less. - `parent_kind` string: Parent object resource kind, for example, Project. - `parent_uuid` string: Parent object UUID. - `references` object: Map of objects referenced in a query API. - `tags` string[]: List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time: Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string: Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time: Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string: Message version. - `spec` V1AgenticInventorySpec - `active_sessions` string, int64: Number of sessions currently in progress (incremented on SESSION_START, decremented on SESSION_STOP). - `agent` AgenticInventoryAgentMeta: AgentMeta holds agent-specific inventory fields. - `agent_version` string: Agent version if available. - `mcp_servers_used` string[]: MCP servers used by this agent. - `models_used` string[]: Models that have been used with this agent. - `sandbox_capable` boolean: Whether this agent supports a built-in sandbox. - `ai_tool` AgenticInventoryAiToolMeta: AiToolMeta holds AI tool-specific inventory fields. - `category` 'AI_TOOL_CATEGORY_UNSPECIFIED' | 'AI_TOOL_CATEGORY_IDE' | 'AI_TOOL_CATEGORY_CLI_TOOL' | 'AI_TOOL_CATEGORY_AGENT' | 'AI_TOOL_CATEGORY_FRAMEWORK' | 'AI_TOOL_CATEGORY_MCP_CONFIG' | 'AI_TOOL_CATEGORY_IDE_EXTENSION' | 'AI_TOOL_CATEGORY_SANDBOX_TOOL': AiToolCategory classifies a detected AI development tool. - AI_TOOL_CATEGORY_SANDBOX_TOOL: Dedicated sandbox tools that wrap an agent, as opposed to an agent's own built-in sandbox. - `evidence` V1AiToolEvidence[]: Evidence supporting the detection. - `key` string: Evidence key (e.g. "install_path", "binary_path", "version", "config_path"). - `value` string: Evidence value. - `sandbox_capable` boolean: Whether this tool supports a built-in sandbox. - `vendor` string: Vendor of the tool (e.g. "Anthropic", "OpenSource", "Google"). - `cmd_hook_events` string, int64: Number of command hook events. - `config_hook_events` string, int64: Number of agent configuration change events. Counted separately from file_hook_events even though a config change is physically a file write, so that file activity and settings churn stay distinguishable. - `error_hook_events` string, int64: Number of hook events that had an error. - `file_hook_events` string, int64: Number of file hook events. - `interrupted_hook_events` string, int64: Number of events that were interrupted. - `last_seen` string, date-time: Timestamp when this inventory was last seen (most recent activity). - `mcp_server` AgenticInventoryMcpMeta: McpMeta holds MCP server-specific inventory fields. - `admin_classification` V1InventoryAdminClassification: InventoryAdminClassification carries the allow/block axis plus evidence. Within a single event, when multiple matching policies disagree, the stronger value wins (BLOCKED dominates ALLOWED dominates UNSPECIFIED). Across events, the current policy set is authoritative: a later event that no longer matches any classification policy leaves the field untouched, but a later event matching a different policy reclassifies the record accordingly. - `evidence` V1InventoryClassificationEvidence: InventoryClassificationEvidence records the policy that assigned the current value on a single classification axis. Snapshotted from the matching AgentHookPolicy so the inventory record remains self-describing after the policy is renamed or deleted. - … - `value` 'ADMIN_LEVEL_UNSPECIFIED' | 'ADMIN_LEVEL_ALLOWED' | 'ADMIN_LEVEL_BLOCKED': AdminLevel is the admin classification level on the allow/block axis. - ADMIN_LEVEL_UNSPECIFIED: No admin classification has been assigned. - ADMIN_LEVEL_ALLOWED: Explicitly allowed by an AgentHookPolicy match. - ADMIN_LEVEL_BLOCKED: Explicitly blocked by an AgentHookPolicy match. - `agents_used` string[]: Agents that have used this MCP server. - `command` string[]: Command + args for stdio transport (e.g. ["npx","-y","@some/mcp"]). - `endpoint` string: Endpoint URL for http/sse transport. - `env_keys` string[]: Names of env vars passed to the server. Values are NEVER persisted. - `models_used` string[]: Models that have been used with this MCP server. - `score_meta` AgenticInventoryMcpScoreMeta: McpScoreMeta groups the riskevaluator outputs written by the jobctl mcpscoring handler. - `risk_level` 'MCP_RISK_LEVEL_UNSPECIFIED' | 'MCP_RISK_LEVEL_LOW' | 'MCP_RISK_LEVEL_MEDIUM' | 'MCP_RISK_LEVEL_HIGH' | 'MCP_RISK_LEVEL_CRITICAL': McpRiskLevel is the categorical risk level produced by the aggregator. - `score` number, float: Headline score 1-10 (higher = safer). Min across category scores with at least one executable check. - `score_dimensions` AgenticInventoryMcpScoreDimensions: McpScoreDimensions holds per-category 1-10 scores from the evaluator. - … - `scored_config_hash` string: SHA-256 of the scored ServerConfig (transport+command+endpoint+env_keys). - `server_host` string: Host or URL of the server (e.g. "localhost", "https://api.example.com"). - `server_type` 'SERVER_TYPE_UNSPECIFIED' | 'SERVER_TYPE_LOCAL' | 'SERVER_TYPE_REMOTE': ServerType indicates whether a tool server runs locally or remotely. - `source` 'MCP_SERVER_SOURCE_UNSPECIFIED' | 'MCP_SERVER_SOURCE_PROJECT_CONFIG' | 'MCP_SERVER_SOURCE_USER_CONFIG' | 'MCP_SERVER_SOURCE_ENTERPRISE_CONFIG' | 'MCP_SERVER_SOURCE_PLUGIN' | 'MCP_SERVER_SOURCE_VENDOR_CONNECTOR' | 'MCP_SERVER_SOURCE_CLIENT_RESERVED' | 'MCP_SERVER_SOURCE_CLIENT_INJECTED': McpServerSource is where an MCP server came from. Orthogonal to ServerType, which answers "where does it run": a vendor connector is a connector by source and REMOTE by type at the same time. Declared here rather than in agentic_inventory.proto because that file imports this one, not the reverse. - MCP_SERVER_SOURCE_UNSPECIFIED: Not classified: no config snapshot was available to check the server against. Distinct from "checked and absent", which is CLIENT_INJECTED. - MCP_SERVER_SOURCE_PROJECT_CONFIG: Registered in the workspace's own checked-in agent config. - MCP_SERVER_SOURCE_USER_CONFIG: Registered in the user's home-directory agent config. - MCP_SERVER_SOURCE_ENTERPRISE_CONFIG: Registered in the OS-managed enterprise agent config. - MCP_SERVER_SOURCE_PLUGIN: Supplied by an agent plugin's manifest rather than by an mcp_servers entry. - MCP_SERVER_SOURCE_VENDOR_CONNECTOR: Vendor hosted connector enabled on the user's agent account, for example a claude.ai connector. Never present in local config. - MCP_SERVER_SOURCE_CLIENT_RESERVED: A name the client reserves for one of its own built in servers, so user config cannot register under it. Highest confidence verdict. - MCP_SERVER_SOURCE_CLIENT_INJECTED: Injected by the client at runtime but not on the reserved list: other product surfaces, IDE bridges, host applications. Absent from a config snapshot that was loaded. - `threat_classification` V1InventoryThreatClassification: InventoryThreatClassification carries the suspicious/malicious axis plus evidence. Within a single event, when multiple matching policies disagree, the stronger value wins (MALICIOUS dominates SUSPICIOUS dominates UNSPECIFIED). Across events, the current policy set is authoritative: see InventoryAdminClassification for the full semantics. - `evidence` V1InventoryClassificationEvidence: InventoryClassificationEvidence records the policy that assigned the current value on a single classification axis. Snapshotted from the matching AgentHookPolicy so the inventory record remains self-describing after the policy is renamed or deleted. - … - `value` 'THREAT_LEVEL_UNSPECIFIED' | 'THREAT_LEVEL_SUSPICIOUS' | 'THREAT_LEVEL_MALICIOUS': ThreatLevel is the threat classification level on the suspicious/malicious axis. - THREAT_LEVEL_UNSPECIFIED: No threat classification has been assigned. - THREAT_LEVEL_SUSPICIOUS: Flagged as suspicious by an AgentHookPolicy match. - THREAT_LEVEL_MALICIOUS: Flagged as malicious by an AgentHookPolicy match. - `tools` string[]: List of tool names available/used from this server. - `transport` string: Transport: "stdio", "http", "sse" (from AgentMCPServer.transport). - `model` AgenticInventoryModelMeta: ModelMeta holds model-specific inventory fields. - `agents_used` string[]: Agents that have used this model. - `mcp_servers_used` string[]: MCP servers used with this model. - `name` string, required: Unique name within the type (e.g. server name for MCP, agent name, model name). - `repositories` string, int64: Number of distinct repositories associated with this inventory item. - `session_hook_events` string, int64: Number of session hook events. - `skill` AgenticInventorySkillMeta: SkillMeta holds skill-specific inventory fields. - `admin_classification` V1InventoryAdminClassification: InventoryAdminClassification carries the allow/block axis plus evidence. Within a single event, when multiple matching policies disagree, the stronger value wins (BLOCKED dominates ALLOWED dominates UNSPECIFIED). Across events, the current policy set is authoritative: a later event that no longer matches any classification policy leaves the field untouched, but a later event matching a different policy reclassifies the record accordingly. - `evidence` V1InventoryClassificationEvidence: InventoryClassificationEvidence records the policy that assigned the current value on a single classification axis. Snapshotted from the matching AgentHookPolicy so the inventory record remains self-describing after the policy is renamed or deleted. - … - `value` 'ADMIN_LEVEL_UNSPECIFIED' | 'ADMIN_LEVEL_ALLOWED' | 'ADMIN_LEVEL_BLOCKED': AdminLevel is the admin classification level on the allow/block axis. - ADMIN_LEVEL_UNSPECIFIED: No admin classification has been assigned. - ADMIN_LEVEL_ALLOWED: Explicitly allowed by an AgentHookPolicy match. - ADMIN_LEVEL_BLOCKED: Explicitly blocked by an AgentHookPolicy match. - `agents_used` string[]: Agents that have used this skill. - `allowed_tools` string[]: Tools declared in SKILL.md frontmatter (allowed-tools). - `compatibility` string: Environment requirements from SKILL.md frontmatter (agentskills.io standard field). - `content` string: Base64-encoded SKILL.md content for backend scoring. Capped at 128 KB. - `content_hash` string: SHA-256 hash of the SKILL.md content. - `description` string: Human-readable description from SKILL.md frontmatter. - `file_count` integer: Number of files in the skill directory (including SKILL.md). - `license` string: License from SKILL.md frontmatter (agentskills.io standard field). - `path` string: Path to the SKILL.md file within the workspace or user home directory. - `risk_dimensions` AgenticInventorySkillRiskDimensions: Deprecated: use SkillScoreDimensions instead. - `data_protection` AgenticInventorySkillRiskDimension: Deprecated: use SkillScoreDimension instead. - … - `external_dependencies` AgenticInventorySkillRiskDimension: Deprecated: use SkillScoreDimension instead. - … - `instruction_integrity` AgenticInventorySkillRiskDimension: Deprecated: use SkillScoreDimension instead. - … - `permission_boundaries` AgenticInventorySkillRiskDimension: Deprecated: use SkillScoreDimension instead. - … - `risk_score` number, float: Deprecated: use score (field 14) instead. Was risk-oriented (higher = riskier). - `score` number, float: Overall score (1-10, higher = safer). Computed by backend LLM analysis. - `score_dimensions` AgenticInventorySkillScoreDimensions: SkillScoreDimensions holds per-dimension scores from LLM security analysis. Each dimension is scored 1-10 (higher = safer) with evidence. - `data_protection` AgenticInventorySkillScoreDimension: SkillScoreDimension holds the score and evidence for a single dimension. - … - `external_dependencies` AgenticInventorySkillScoreDimension: SkillScoreDimension holds the score and evidence for a single dimension. - … - `instruction_integrity` AgenticInventorySkillScoreDimension: SkillScoreDimension holds the score and evidence for a single dimension. - … - `permission_boundaries` AgenticInventorySkillScoreDimension: SkillScoreDimension holds the score and evidence for a single dimension. - … - `scored_content_hash` string: SHA-256 hash of the content that was last scored. Used to detect drift and decide whether re-scoring is needed. - `threat_classification` V1InventoryThreatClassification: InventoryThreatClassification carries the suspicious/malicious axis plus evidence. Within a single event, when multiple matching policies disagree, the stronger value wins (MALICIOUS dominates SUSPICIOUS dominates UNSPECIFIED). Across events, the current policy set is authoritative: see InventoryAdminClassification for the full semantics. - `evidence` V1InventoryClassificationEvidence: InventoryClassificationEvidence records the policy that assigned the current value on a single classification axis. Snapshotted from the matching AgentHookPolicy so the inventory record remains self-describing after the policy is renamed or deleted. - … - `value` 'THREAT_LEVEL_UNSPECIFIED' | 'THREAT_LEVEL_SUSPICIOUS' | 'THREAT_LEVEL_MALICIOUS': ThreatLevel is the threat classification level on the suspicious/malicious axis. - THREAT_LEVEL_UNSPECIFIED: No threat classification has been assigned. - THREAT_LEVEL_SUSPICIOUS: Flagged as suspicious by an AgentHookPolicy match. - THREAT_LEVEL_MALICIOUS: Flagged as malicious by an AgentHookPolicy match. - `tool_hook_events` string, int64: Number of tool hook events. - `total_duration_msec` string, int64: Sum of all hook event durations in milliseconds. - `total_hook_events` string, int64: Total number of hook events. - `type` 'INVENTORY_TYPE_UNSPECIFIED' | 'INVENTORY_TYPE_AGENT' | 'INVENTORY_TYPE_MODEL' | 'INVENTORY_TYPE_MCP_SERVER' | 'INVENTORY_TYPE_SKILL' | 'INVENTORY_TYPE_AI_TOOL', required: InventoryType discriminates agent, model, MCP server, skill, and AI tool inventory in the unified collection. - `user_prompt_hook_events` string, int64: Number of user prompts submitted. - `users` string, int64: Number of distinct users that triggered events for this inventory item. - `tenant_meta` V1TenantMeta: Tenant related data for the tenant containing the resource. - `namespace` string, required: Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". - `uuid` string: The UUID of the inventory record. - `response` V1ListResponse: Response to a list request. - `next_page_id` string: The UUID of last message retrieved. - `next_page_token` integer: Pagination token that can be used to retrieve the next page of results. ## Other responses - `default`: An unexpected error response. ## Changes - **2026-11-03** `4acd9fe15140`: 1 info - endpoint added [Operation history](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/changes/v1/namespaces/:tenant_meta.namespace/agentic-inventory/get.md) --- [API](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference.md) - [All operations](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/llms.txt) - [OpenAPI document](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/revisions/4acd9fe15140?raw)