Open-source scanner that discovers rogue and shadow AI agents by scanning endpoints, cloud AI platforms, managed agent environments, network logs and SIEMs, then forwards every finding to Elasticsearch, Splunk or a webhook. Headless, read-only and runnable locally via Docker or Kubernetes.
Deckard is Arthur's open-source scanner for finding AI agents across cloud platforms and workloads, endpoints, network or gateway logs, and security telemetry. It sends discovered-agent records and scan outcomes to Elasticsearch, Splunk, or an HTTPS webhook. Deckard runs in the user's environment and is designed to scan read-only; its configuration specifies sources, a scan schedule, and a destination. The documentation describes Docker Compose and Kubernetes deployment options, with integrations including AWS, Google Cloud, Jamf Pro, Vercel, Splunk, and Elastic Security.
Deckard's documented local scan workflow uses osquery queries via its scan-local.sh script.
Be the first Cosign
Add it to your Products I use list. You can also share why you use it.
