Today
Shadow models with no owner.
Shadow AI lives in GitHub orgs, side projects, and vendor tools. Ownership is unclear until an auditor asks.
- Side project
- Unknown
- Vendor tool
- No owner

Detect AI
Find the models and agents that were already shipping.
Zenjin Detect AI finds unsanctioned models, agents, and MCP servers in your codebase, promotes them into a governed inventory, and produces AIBOM / AgBOM so you know what is actually running.
Scan
GitHub org, day zero
Inventory
Apps, models, MCP
AIBOM
What the app runs
AgBOM
What the agent can call
Shadow models and MCP servers do not wait for a spreadsheet. Detect AI scans the org, promotes what it finds, and writes AIBOM / AgBOM for what actually runs.
Find unsanctioned LLMs, agents, and MCP servers in the codebase.
Models, applications, and MCP/agents with owners and lifecycle, not a spreadsheet.
Generate an AI bill of materials for applications headed to production.
Agent/MCP bill of materials plus BOM policies before something ships.

If it is not in inventory, it is a rumor.
Today
Shadow AI lives in GitHub orgs, side projects, and vendor tools. Ownership is unclear until an auditor asks.

With Zenjin
Org scans feed Application, Model, and MCP/Agent inventory. AIBOM and AgBOM make the bill of materials part of the same record.

Scan the org, name what you found, put a bill of materials on it.
01
GitHub organization scan, standard or deep, on day zero and on a cadence.

02
Repos become applications. Scan assets become models, MCPs, and agents with owners.

03
AIBOM for applications, AgBOM for MCP/agents, with production policy checks.

Detect AI finds what exists. Inventory owns it. AIBOM / AgBOM describe the running system so governance is not a document someone wrote once.
GitHub org scan is the day-zero path. Promoted assets become the catalog the rest of the platform (Data Security Posture Management, agentic red teaming, evals) operates on.
AgBOM is the bill of materials for agents and MCP servers: tools, models, and components the agent can call, with production checks.
The org scan finds MCP usage. You promote those assets into MCP / agent inventory, then generate AgBOM for what is allowed to run.
Yes. Shadow models, agents, and MCP servers in the org are the point of the scan, including standard and deep GitHub organization scans.
You promote into inventory, attach owners, generate AIBOM / AgBOM, and the other products (Data Security Posture Management, evals, red teaming) operate on that catalog.