Skip to main content
Artifact Inventory shows what is installed across your developers’ AI coding agents. Corridor scans each developer’s coding-agent configuration and builds a team-wide catalog of MCP servers, agent skills, hook configurations, harness plugins, and editor extensions. The catalog shows who has each artifact, how many devices it appears on, and whether it has security findings (such as plaintext credentials).
Artifact Inventory is part of Agent Governance and is available on the Enterprise plan. Corridor collects coding-agent configuration for Claude Code, Cursor, and OpenAI Codex. It collects editor extensions from the VS Code family (VS Code, Cursor, Devin Desktop) and JetBrains IDEs.

​
What’s in the inventory

Open Governance → Inventory in the Corridor dashboard. The All view combines every artifact type and includes type filters, text search, and a security-only toggle. Separate views cover MCP, Skills, Hooks, Plugins, and Extensions. Each artifact shows its presence (the developers and devices that have it), its enabled or disabled state on each device, when it was first and last seen, and any security signals. Expand a row to see installations by device, then select an installation to open its details.

​
Security signals

Artifacts can show these security signals:
  • Secret findings: Corridor scans artifact configuration for embedded credentials, including API keys, tokens, passwords, and credentials in URLs. A finding names the detector and affected field but never includes the secret value.
  • Disabled on devices: Corridor flags an artifact when it is disabled on some devices but enabled on others.

​
What gets scanned

Corridor’s hooks scan known user, project, and plugin configuration locations for each supported coding agent: Editor extensions are collected separately from the coding-agent configuration. Corridor collects each extension’s enabled or disabled state from the VS Code family (VS Code, VS Code Insiders, Cursor, Devin Desktop) and JetBrains IDEs.
Cursor MCP servers registered at runtime without a configuration file are not visible to the file-based scan. Corridor parses Codex configuration on a best-effort basis.

​
How collection works

The Corridor hooks binary, installed with the CLI or IDE extension, runs an inventory scan in the background about every 30 minutes while a coding agent is in use. Each scan:
  1. Reads known coding-agent and editor configuration locations on the device.
  2. Masks credential-shaped values in MCP, hook, and plugin configuration snippets before upload, so that Corridor never accesses or stores your credentials. Agent skill bundles are uploaded as complete, content-addressed bundles so teams can inspect and download them from the Inventory.
  3. Sends the artifact catalog to Corridor, where it is merged into your team’s inventory.
The scan runs separately from the agent’s workflow. A scan failure does not interrupt the developer or agent.

​
Enabling and disabling

Artifact Inventory requires the Enterprise plan. Your team controls collection:
  • In Team Settings → Agent Observability, the Artifact Inventory toggle controls collection for the whole team. Only team Owners can change it.
  • Turning the toggle off makes the server drop incoming inventory data immediately. Connected clients stop sending it shortly afterward.
  • Team Owners and Admins can view the inventory.

​
Next steps

MCP Tool Controls

Set allow/block policy for MCP servers and tools