AI Asset Inventory — Research Plan

Plan for finding existing examples of "inventory" pages relevant to an AI asset inventory (agents, MCP servers, files, models, etc.), with screengrabs where possible. Round 1 (AI-focused) and Round 2 (general inventory) executed 2026-07-31; results in precedents.md and precedents/.

Question

What does a good inventory page look like for AI assets? Specifically:

• What entity types do incumbents inventory (agents, models, MCP servers, datasets, non-human identities…)?
• What layout grammar carries the list — table, cards, facets, treemap, graph?
• What columns / overlays matter — posture badges, risk scores, usage counts, owners, last-seen?
• How are shadow / unapproved assets flagged and distinguished from sanctioned ones?
• What is the drill-down target from a list row — detail page, side panel, graph?

Target categories

1. AI-SPM / AI security inventories (closest competitors)

The products whose inventory pages answer nearly the same question as Qpoint's.

• Wiz AI-SPM — AI-BOM / AI inventory of models, services, SDKs
• Microsoft Purview / Defender for Cloud AI — shadow-AI discovery, AI app inventory
• Zenity — agent inventory (low-code + AI agents)
• Astrix / Token Security — non-human identity inventories
• Nightfall — MCP server / shadow-AI inventory
• Protect AI (Radar), Noma, Lasso, Prompt Security — AI asset discovery surfaces

2. Agent observability platforms

How dev-facing tools list agents, traces, models, tools.

• LangSmith, Langfuse, Arize Phoenix, Galileo, Helicone

3. Cloud consoles

First-party agent/model list pages.

• Azure AI Foundry (agents list), AWS Bedrock (agents/models console), Google Vertex AI Agent Builder

4. MCP registries & gateways

How MCP servers specifically are cataloged — cards vs. tables, trust/verification badges.

• Official MCP registry, Smithery, Docker MCP Catalog, Cloudflare MCP portals, MCP gateways (e.g. Obot)

5. Classic inventory grammar (reference patterns, not competitors)

Mature asset-inventory UI conventions worth borrowing.

• Wiz cloud Inventory, Axonius (cyber-asset inventory), ServiceNow CMDB
• SaaS management (Torii, Zluri), API inventory (Salt, Noname), device management (Kandji, Jamf)

6. Internal prior art (no screengrabs)

• c6 raw inventory surface, c12 inventory-deep-dive (category theses, list/detail jumps, repos entity)
• c16 fleet data (app/data/c16-fleet.ts) — agent/MCP vocabulary already in use

Capture method

Proven in c18 (post-mortem-map):

1. WebSearch to locate vendor docs, blogs, and architecture guides showing the actual product UI.
2. WebFetch pages to confirm the image shows an inventory view worth keeping.
3. Download images via curl into precedents/ with descriptive kebab-case names (e.g. wiz-ai-spm-inventory.png).
4. Verify each file is a real image (magic bytes, non-trivial size) — WAF'd hosts return HTML error pages.
5. Record every capture in precedents/README.md: file | shows | source URL. Sources that 403 or are video-only go in a "Not captured" section with links.

Best source types, in order: GitHub-hosted docs repos (e.g. MicrosoftDocs), vendor docs sites, vendor blogs, cloud-provider architecture guides, press kits.

Budget: ~8–15 good screengrabs across categories. Breadth over completeness — this is a starter cycle.

Output

• precedents/ — screengrabs + sourced README
• precedents.md — per-product notes grouped by category, extracted patterns (what every good inventory page does), gap statement (what nobody draws yet for agents + MCP servers + files together), and 5–10 implications for the future c19 inventory brief

Round 2 — general (non-AI) inventory pages

Second pass over inventory UIs from any domain, for grammar rather than competition:

• Network/infrastructure (DCIM/IPAM): NetBox ✓ (open source, docs screenshots), Lansweeper ✗
• Developer catalogs: Backstage software catalog ✓ (open source), Datadog Service Catalog ✗ (JS docs)
• IT asset management: Ralph ✓ (open source, README tour), Snipe-IT ✗ (docs images not reachable), GLPI (not pursued)
• Vulnerability-centric asset inventory: Tenable ✓ (static docs), Qualys ✗ (not pursued), runZero ✗ (JS site)
• Device fleet / MDM: Intune ✗ (docs paths 404d), Jamf/Kandji ✗ (WAF/JS), Fleet ✗ (marketing renders only)
• CMDB: ServiceNow ✗ (docs WAF'd)
• Cloud resource inventory: AWS Config / GCP Cloud Asset Inventory ✗ (JS-rendered console docs)
• Commerce/stock: Shopify, WooCommerce, Square ✗ (help centers expose no static screenshots) — covered in prose only
• Dependencies as inventory: GitHub dependency graph ✗ (docs images are tiny crops) — covered in prose

Lesson from both rounds: open-source projects and GitHub-hosted docs repos are reliably capturable; JS-rendered marketing sites and help centers are not.