Map every AI surface,
even the agents
nobody registered.

AI Surface Intelligence is Wingback's continuous discovery layer. It maps every agent, model, MCP server, tool, prompt, and data source running across your cloud accounts, source repositories, and engineering workstations, profiles each one for configuration, exposure, change history, and ownership, scores it on a calibrated 0-100 scale, and routes the finding to the team that owns the fix.

Anything that runs a model or reaches one: an agent, a hosted or self-hosted model, an MCP server, a tool or function an agent can call, a system prompt, a vector store, and the inference path between them. A ChatGPT tab on an engineer's laptop and a Bedrock agent in a production account are both assets, and both arrive with an owner and a score.

No. Cloud and code discovery is agentless: Wingback reads your AWS, GCP, and Azure accounts and your GitHub, GitLab, and Bitbucket repositories through their own APIs. Workstation coverage uses an endpoint sensor on macOS, Windows, and Linux. Nothing has to be rebuilt, re-registered, or pointed at a proxy before it can be found.

A CSPM can tell you a Bedrock endpoint exists. It cannot tell you which agent calls it, which tools that agent can reach, which system prompt it runs, or who owns it. Wingback resolves the AI layer specifically: the agent, its tool scope, its data lineage, and the human accountable for it.

AI tool activity, not general browsing: ChatGPT and Claude sessions, Cursor, Claude Code, and Copilot use, local MCP servers over STDIO, personal API keys, local Ollama and LM Studio instances, browser extensions calling models, and data leaving to providers you have not sanctioned.

Every asset carries a calibrated 0-100 score built from four weighted factors: configuration at 30 percent, change history at 25 percent, exposure at 25 percent, and ownership clarity at 20 percent. Engineers sort by score and fix the worst first, and the score moves when the configuration moves rather than on a review cycle.

Findings are tagged at discovery time against ISO 42001, the NIST AI RMF, the OWASP LLM Top 10, the EU AI Act, and MITRE ATLAS, so a discovery finding arrives as a compliance artefact rather than becoming one later.

It is profiled, scored, and routed. The finding goes to the team that owns the fix with a response SLA attached, rather than into a single security queue, and the asset stays under continuous assessment so drift, a widened permission, or a silent model swap raises a new finding.

Wingback reads your AWS, GCP, and Azure accounts and your GitHub, GitLab, and Bitbucket repositories through their own APIs. Cloud and SaaS coverage includes AWS Bedrock and AgentCore, Azure OpenAI and AI Foundry, Microsoft Copilot Studio, Salesforce Agentforce, SageMaker endpoints, self-hosted LLMs such as vLLM and Ollama, and RAG indexes and vector stores. In code it finds OpenAI and Anthropic SDK calls, LangChain, AutoGen, and LlamaIndex agents, hard-coded system prompts, and MCP server registrations.

Yes. In code, discovery reads MCP server registrations in your repositories; on laptops, the endpoint sensor sees local MCP servers running over STDIO. Coverage spans the MCP ecosystem, including GitHub, Linear, Slack, Notion, filesystem, and database MCPs. Each server is profiled for its permission scope, owner, approval state, runtime usage, and change diff, so a server that gains filesystem:write raises a new finding.

It looks where AI actually runs, not where it was registered. On laptops, the endpoint sensor catches a personal ChatGPT account pasting strategy documents or a Cursor session reading customer records. In the cloud and in code, scans and drift comparison surface a Bedrock agent in a dev account holding production credentials, a self-hosted model with no authentication, or an MCP server that gained filesystem:write. Every first scan surfaces AI assets the CISO can't account for, and each one arrives with an owner and a score.

One step, done once: you point Wingback at your cloud accounts, source repositories, and engineering endpoints. Cloud and code are read agentlessly through the providers' own APIs, and laptops run an endpoint sensor on macOS, Windows, and Linux, so nothing has to be rebuilt, re-registered, or pointed at a proxy. Connect your cloud and code, and you'll have a scored inventory in under an hour.

Continuously. Discovery is a standing process, not a scan you schedule: once connected, the collectors keep running, and new assets land in the inventory as they are found and pick up a risk score in seconds. Every asset stays under continuous assessment, so drift, a widened permission, or a silent model swap raises a new finding, and the score moves when the configuration moves rather than on a review cycle.

Yes. Discovery is a graph, not a list: Wingback maps every dependency between agents, models, tools, and data sources, so you can answer the questions you actually get asked, such as which agents touch PHI, which workflows depend on a deprecated model, and which integration would break if a vendor goes down. Each data source carries its sensitivity class and the agents that read it.

Yes. Discovery produces a CycloneDX 1.6 AI bill of materials (AIBOM) for each model and agent, versioned and exportable.