> ## Documentation Index
> Fetch the complete documentation index at: https://docs.corridor.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Artifact Inventory

> A continuously updated catalog of the MCP servers, Agent skills, hooks, plugins, and editor extensions used across your team's coding agents.

Artifact Inventory shows what is installed across your developers' AI coding agents. Corridor scans each developer's coding-agent configuration and builds a team-wide catalog of MCP servers, agent skills, hook configurations, harness plugins, and editor extensions. The catalog shows who has each artifact, how many devices it appears on, and whether it has security findings (such as plaintext credentials).

<Note>
  Artifact Inventory is part of [Agent Governance](/agent-governance/overview) and is available on the **Enterprise** plan. Corridor collects coding-agent configuration for **Claude Code**, **Cursor**, and **OpenAI Codex**. It collects editor extensions from the VS Code family (VS Code, Cursor, Devin Desktop) and JetBrains IDEs.
</Note>

## What's in the inventory

Open **Governance → Inventory** in the Corridor dashboard. The **All** view combines every artifact type and includes type filters, text search, and a security-only toggle. Separate views cover **MCP**, **Skills**, **Hooks**, **Plugins**, and **Extensions**.

Each artifact shows its **presence** (the developers and devices that have it), its **enabled or disabled** state on each device, when it was **first and last seen**, and any **security signals**. Expand a row to see installations by device, then select an installation to open its details.

| Artifact type           | What you see                                                                                                                                    |
| ----------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
| **MCP servers**         | Transport (stdio/HTTP/SSE), configuration scope (user, project, or plugin), a masked configuration snippet, and the tools exposed by the server |
| **Agent skills**        | Version, file count and size, content address, a bill of materials with the hash of every file in the skill bundle, and a bundle download       |
| **Hook configurations** | Events, matcher, and a masked configuration snippet                                                                                             |
| **Plugins**             | Version, marketplace, scope, author, and bundled MCP servers, hooks, skills, commands, and agents                                               |
| **Editor extensions**   | Extension ID, version, publisher, host IDE, and editor compatibility range                                                                      |

### Security signals

Artifacts can show these security signals:

* **Secret findings**: Corridor scans artifact configuration for embedded credentials, including API keys, tokens, passwords, and credentials in URLs. A finding names the detector and affected field but never includes the secret value.
* **Disabled on devices**: Corridor flags an artifact when it is disabled on some devices but enabled on others.

## What gets scanned

Corridor's hooks scan known user, project, and plugin configuration locations for each supported coding agent:

|                                                | Claude Code | Cursor | Codex |
| ---------------------------------------------- | :---------: | :----: | :---: |
| MCP servers (user, project, and plugin scopes) |      ✓      |    ✓   |   ✓   |
| Agent skills                                   |      ✓      |    ✓   |   —   |
| Hook configurations                            |      ✓      |    ✓   |   ✓   |
| Plugins                                        |      ✓      |    ✓   |   —   |

Editor extensions are collected separately from the coding-agent configuration. Corridor collects each extension's enabled or disabled state from the VS Code family (VS Code, VS Code Insiders, Cursor, Devin Desktop) and JetBrains IDEs.

<Note>
  Cursor MCP servers registered at runtime without a configuration file are not visible to the file-based scan. Corridor parses Codex configuration on a best-effort basis.
</Note>

## How collection works

The Corridor hooks binary, installed with the CLI or IDE extension, runs an inventory scan in the background about every 30 minutes while a coding agent is in use. Each scan:

1. Reads known coding-agent and editor configuration locations on the device.
2. Masks credential-shaped values in MCP, hook, and plugin configuration snippets before upload, so that Corridor never accesses or stores your credentials. Agent skill bundles are uploaded as complete, content-addressed bundles so teams can inspect and download them from the Inventory.
3. Sends the artifact catalog to Corridor, where it is merged into your team's inventory.

The scan runs separately from the agent's workflow. A scan failure does not interrupt the developer or agent.

## Enabling and disabling

Artifact Inventory requires the Enterprise plan. Your team controls collection:

* In **Team Settings → Agent Observability**, the **Artifact Inventory** toggle controls collection for the whole team. Only team **Owners** can change it.
* Turning the toggle off makes the server drop incoming inventory data immediately. Connected clients stop sending it shortly afterward.
* Team **Owners** and **Admins** can view the inventory.

## Next steps

<CardGroup cols={1}>
  <Card title="MCP Tool Controls" icon="plug" href="/agent-governance/mcp-tool-controls">
    Set allow/block policy for MCP servers and tools
  </Card>
</CardGroup>