Skip to main content
Founding Customer: 50% off year 1 — first 50 customers · code FOUNDING50
NetInsightPro
Guide

How to discover every MCP server and AI agent on your fleet

Developers install AI assistants — Claude Desktop, Cursor, Copilot, Windsurf — and wire up MCP (Model Context Protocol) servers in seconds, often with filesystem or shell access and appearing in no asset register. Here is how to find them: first the free manual method you can run today, then how to turn it into a continuous fleet-wide inventory.

Why shadow AI agents and MCP servers hide

An MCP server is a small local program an AI assistant launches to give itself new powers — read your files, run shell commands, call an API, query a database. Two things make them easy to miss. First, most run over stdio (a local pipe to the host app), so they never open a network connection you would spot in a firewall log. Second, they are declared in per-user config files and spawned on demand — no installer, no service, no asset-register entry. A remote MCP server is the opposite: it talks over HTTP/SSE, so it does show up as outbound traffic. You need to look in more than one place.

The free way, step by step

Find MCP servers & AI agents on one machine, for free

No product required. These three checks — config files, running processes, and outbound connections — are exactly the signals a good scanner looks at, and you can run them by hand on any machine today.

1. Read the MCP client config files

Every MCP client registers its servers in a JSON config under an mcpServers block. Each entry’s command and args tell you exactly what will run — and any secrets declared in env are worth a second look.

A typical mcpServers block
{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-filesystem", "/"]
    },
    "github": {
      "command": "docker",
      "args": ["run", "-i", "--rm", "ghcr.io/example/mcp-github"],
      "env": { "GITHUB_TOKEN": "ghp_…" }
    }
  }
}

An entry with "disabled": true is still registered but not currently active — worth noting, not ignoring.

Where to look (per user). Some of these are community-derived rather than vendor-documented — Windsurf/Codeium and the Claude Desktop path on Linux in particular — so verify against each vendor’s current docs:

Windows
  • Claude Desktop%APPDATA%\Claude\claude_desktop_config.json
  • VS Code (Copilot / MCP)%APPDATA%\Code\User\settings.json
  • Cursor (global)%USERPROFILE%\.cursor\mcp.json
  • Windsurf / Codeium%USERPROFILE%\.codeium\windsurf\mcp_config.json
  • Continue%USERPROFILE%\.continue\config.json
Linux
  • Claude Desktop (community build)~/.config/Claude/claude_desktop_config.json
  • VS Code (Copilot / MCP)~/.config/Code/User/settings.json
  • Cursor (global)~/.cursor/mcp.json
  • Windsurf / Codeium~/.codeium/windsurf/mcp_config.json
  • Continue~/.continue/config.json

Also check project-scoped configs a developer may have committed (for example a.cursor/mcp.jsonor.vscode/mcp.jsoninside a repo). On macOS the same files live under ~/Library/Application Support/… — the manual method is OS-agnostic. App-specific paths change; verify against each vendor’s current docs (as at September 2026).

2. Inspect running processes (mind the parent)

A running MCP server is usually a npx/node/uvx/python or docker process whose parent is the AI host app. Matching a child’s parent PID back to Claude Desktop, Cursor or VS Code confirms the assistant launched it.

Linux — list candidates with their parent
ps -eo pid,ppid,comm,args \
  | grep -Ei 'mcp|modelcontextprotocol|claude|cursor|windsurf|continue' \
  | grep -v grep
Windows (PowerShell) — pid, parent, command line
Get-CimInstance Win32_Process |
  Select-Object ProcessId, ParentProcessId, Name, CommandLine |
  Where-Object { $_.CommandLine -match 'mcp|modelcontextprotocol|npx|uvx' }

3. Watch outbound connections to AI / LLM hosts

The AI agent itself — and any remote (HTTP/SSE) MCP server — reaches out to provider APIs. Look for established connections to hosts like api.anthropic.com, api.openai.com, generativelanguage.googleapis.com, api.cursor.com, codeium.com, api.deepseek.com or api.mistral.ai.

Linux — established sockets and the owning process
sudo ss -tnp state established
# or
sudo lsof -i -nP | grep ESTABLISHED
Windows (PowerShell) — connections by process
Get-NetTCPConnection -State Established |
  Select-Object OwningProcess, RemoteAddress, RemotePort
# map the PID with:  netstat -ano

Two honest caveats. Provider APIs sit behind CDNs, so you will usually see an IP, not a name — pair this with DNS query logs to resolve it. And local stdio MCP servers open no socket at all: they only show up in steps 1 and 2, never here.

Where the manual method runs out

  • It is a snapshot of one machine at one moment. Agents and MCP servers are added, disabled and removed constantly.
  • You still have to judge the risk yourself — which permissions are dangerous, which providers are unrecognised, which servers hold secrets.
  • It does not scale to a fleet. Repeating three commands on every laptop, on a schedule, and keeping one deduplicated inventory, is the tedious part — and the part worth automating.

Once you know what’s running, the next job is hardening it. See the companion practical checklist for securing MCP servers. And for why these native apps slip past your browser DLP entirely, see the Claude Desktop & Cursor local-tool blind spot — or, for the threat that makes a risky server dangerous, read what MCP tool poisoning is.

The automated answer

Turn those three checks into a live fleet inventory

NetInsightPro runs the same signals as the manual method — the known MCP client config files and the running processes — automatically, on every device reporting into your workspace, across Windows, Linux and Android. It builds one inventory, scores each asset with evidence, and lets you act. AI-agent & MCP security is live on Pro today.

Automatic cross-platform discovery

The same config-file and running-process inspection you would do by hand — run continuously on every device, on Windows, Linux and Android. It catches local stdio MCP servers a network scan would miss.

One deduplicated fleet inventory

Every asset in one place: its type (agent / MCP server / MCP tool), the device it runs on, its provider, whether it is active or stale, and when it was last seen — reduced to the latest known state.

Evidence-based risk scoring

Each asset scored Low, Medium, High or Critical from its declared permissions, provider recognition and secret exposure — with the evidence behind every score shown, not a black-box number. Vulnerability scanning is included and rolling out; today’s scoring is heuristic and evidence-backed.

One-click block, with an audit trail

Block a risky asset per destination host through the OS firewall in one click — so it lands on agents and servers that talk to a network endpoint. On-device quarantine for locally-run (stdio) assets is rolling out. Enterprise adds policies, automatic blocking and a SOC view.

We’re early to this category and honest about the edges: for deep per-server static analysis of an MCP server — tool poisoning, prompt injection — a code-level scanner such as Snyk or Invariant Labs goes further, and NetInsightPro complements, not replaces, it. What NetInsightPro adds is fleet-wide endpoint discovery of what is actually running, and one place to act on it.

What we won’t claim

A guide you can trust says where its product loses. Here is exactly what NetInsightPro does not do, so you can decide with clear eyes.

NetInsightPro discovers by inspecting config files and processes on each device — it does not sniff the network for MCP servers. The manual method above is a real, free alternative; we don’t pretend it isn’t.

Blocking is per destination host, enforced through the OS firewall — not per app process, and not by killing a live connection. A purely local stdio MCP server has no destination host; on-device quarantine for those is rolling out.

There is no macOS blocking. Automated discovery and blocking cover Windows, Linux and Android. The manual steps above work on a Mac; NetInsightPro’s one-click block does not.

It runs alongside your antivirus and any code-level MCP scanner — never instead of them. Vulnerability scanning is included and rolling out; we do not claim deep per-package CVE analysis. No fabricated metrics or logos.

Frequently asked questions

Inventory the AI agents & MCP servers on your fleet

Start free on up to two devices, or go Pro for cross-platform discovery, inventory, evidence-based risk scoring and one-click block. Runs alongside your antivirus. Data stays on-device.

Start freeSee pricing

Want the full picture? Explore AI-agent & MCP security.