find which ai coding agents are installed on company laptops

Start with an Inventory

You cannot write a policy for agents you do not know about. Most security teams that survey developers find more agents than they expected: a Claude Code install here, Codex CLI there, Cursor everywhere, and a few people trying Gemini CLI or OpenCode. A detection script turns guesswork into a list.

What Each Agent Leaves Behind

These are heuristics, not guarantees. Directories can remain after uninstall, and binaries can live in non-standard locations. Treat a hit as “this person has used it”, and verify on a sample of machines before relying on the list.

Detection Script

It checks fixed install locations as well as the user’s home, because a login shell started from a management agent reads .zprofile but not .zshrc, where nvm and many npm global paths are set. Labels read <tool>:<signal>, so you can tell a leftover config directory from an installed binary.

For Jamf, add it as a computer extension attribute. For Intune, add it under Devices > macOS > Organize devices > Custom attributes for macOS with data type String, and remove the <result> wrapper so it echoes only the list; Intune runs custom attribute scripts every 8 hours and shows the echoed value in the Result column. Output must stay under 20 KB.

#!/bin/bash
# Reports AI coding agents found for the logged-in user.
# Jamf: computer extension attribute. Intune: custom attribute for macOS (drop the <result> wrapper).
user=$(stat -f%Su /dev/console)
case "$user" in
  ""|root|_mbsetupuser|loginwindow) echo "<result>no-user</result>"; exit 0 ;;
esac
home=$(dscl . -read "/Users/$user" NFSHomeDirectory | sed 's/^NFSHomeDirectory: //')
found=()
add() { found+=("$1"); }

# Config left in the home directory
{ [ -e "$home/.claude" ] || [ -e "$home/.claude.json" ]; } && add "claude:config"
[ -e "$home/.codex" ] && add "codex:config"
[ -e "$home/.cursor" ] && add "cursor:config"
[ -e "$home/.copilot" ] && add "copilot:config"
[ -e "$home/.gemini" ] && add "gemini-or-antigravity:config"
[ -d /Applications/Cursor.app ] && add "cursor:app"

# Binaries in common install locations (a login shell misses PATH set in .zshrc)
bindirs=("$home/.local/bin" "$home/.npm-global/bin" "$home/.bun/bin" /opt/homebrew/bin /usr/local/bin)
for d in "$home"/.nvm/versions/node/*/bin; do [ -d "$d" ] && bindirs+=("$d"); done
for b in claude codex copilot gemini opencode goose; do
  for d in "${bindirs[@]}"; do
    if [ -x "$d/$b" ]; then add "$b:binary"; break; fi
  done
done

# VS Code extensions
ext="$home/.vscode/extensions"
ls "$ext" 2>/dev/null | grep -q '^anthropic\.claude-code' && add "claude:vscode"
ls "$ext" 2>/dev/null | grep -q '^openai\.chatgpt' && add "codex:vscode"
ls "$ext" 2>/dev/null | grep -q '^github\.copilot' && add "copilot:vscode"

result=$(printf '%s\n' "${found[@]}" | grep -v '^$' | sort -u | paste -sd, -)
echo "<result>${result:-none}</result>"

From Installed to Actually Used

Presence is not activity. failproofai audit scans the agent histories already on a machine (Claude Code, Codex, Copilot CLI, Cursor, OpenCode, Pi, Hermes, OpenClaw, Factory, Devin, Antigravity and Goose), replays the tool activity through Failproof’s built-in policies and opens a local report at localhost:8020/audit, with no account or network connection. failproofai audit --schedule 7 --email security@example.com repeats it weekly and emails the findings; that first setup signs you in when needed.

From Inventory to Control

1. Group machines by which agents they run. That is your coverage target.
2. Decide which agents are sanctioned. Unsanctioned ones get removed or replaced; see personal AI accounts at work.
3. Install the policy client on every machine that has a supported agent. failproofai config detects installed agent CLIs and hooks each supported one; Gemini CLI is not among Failproof’s twelve supported harnesses, so govern it through its own system settings.
4. Watch coverage centrally under Admin → enforcement, and re-run the inventory on a schedule to catch new installs.