Here's the whole post in one line, quotable if you only read this far: an AI agent you haven't written down is an agent you can't secure, bill, or switch off — so keep one checked-in registry of every agent and LLM surface you run, generate half of it by scanning your code for provider SDKs, and gate new agents behind a one-line CI check.

That is, minus the enterprise price tag, exactly what the security startups are selling. When Neo left stealth on July 20 with $100M to give big companies "inventory, posture intelligence, attribution, and policy control" over their agents, the first noun was inventory. The pitch rests on a Gartner figure — 5% of enterprise apps had agentic capabilities in 2025; 40% will by the end of 2026 — which is a polite way of saying most agents show up without anyone deciding to deploy them. You're small enough to fix that with a file. Do it now, while you still can hold the answer in your head.

Step 1: Write the registry — one file, six fields#

Put a single agents.yaml at the root of your repo. Review changes to it in pull requests, exactly like code. Every agent gets one entry, and every field earns its place by answering a question you'll be asked in an incident:

# agents.yaml — the one list that knows what can act on our behalf
- name: support-triage-bot
  owner: dex                      # the human accountable. No owner = the one that leaks.
  trigger: webhook:zendesk        # cron | webhook | user | agent — your real attack surface
  model: claude-sonnet-5          # which capability tier it runs on
  provider: anthropic             # which key it burns, whose outage kills it
  tools:                          # blast radius: every capability it can invoke
    - zendesk.reply
    - kb.search
  data_scope: read:tickets, write:ticket-comments   # bug vs. breach lives here
  kill: "disable ANTHROPIC_API_KEY in Zendesk app + set FEATURE_TRIAGE=off"  # <60s to stop

The kill field is the one people skip and the one that matters most. If you can't name the exact command or flag that stops an agent in under a minute, it isn't under your control yet — it's just running.

Step 2: Find the agents you already forgot#

You won't remember all of them. Agents hide in three layers: the ones you wrote, the ones inside tools you bought, and the ones an LLM can spawn (a coding agent with shell access, a planner that launches sub-agents). Scan for their fingerprints — provider SDKs and API-key names:

# code: every place that imports a model provider or an agent framework
rg -n -i "openai|anthropic|google\.generativeai|langchain|langgraph|crewai|llama_index|mcp" \
  --glob '!node_modules' --glob '!*.lock'

# secrets/env: every model key that exists at all
rg -n -i "(OPENAI|ANTHROPIC|GOOGLE|GROQ|MISTRAL|COHERE|OPENROUTER)_API_KEY" \
  .env* 2>/dev/null; env | rg -i "_API_KEY"

Anything that hits a model on a schedule or a webhook is an agent whether or not you called it one. Then do the unglamorous half: open the admin panel of every SaaS tool you pay for and check what it turned on. Plenty of vendors flipped "agentic" features to on by default in 2026 — your CRM, your inbox, your IDE. Each one that can take an action goes in the file, with an owner and a kill switch, or it gets turned off.

For the tools field, enumerate honestly. If an agent reaches its tools over MCP, list the servers it's connected to — a single MCP connection can expose a dozen capabilities, and "connected to the filesystem server" is a blast radius, not a footnote.

Step 3: Make the registry impossible to skip#

An inventory that depends on you remembering to update it is already out of date. Turn it into a merge condition. Add a CI step that fails the build when a change introduces a new model call without touching the registry:

#!/usr/bin/env bash
# ci/check-agent-registry.sh — fail if new model calls arrive without a registry update
set -euo pipefail
NEW_CALLS=$(git diff origin/main... --unified=0 \
  | rg '^\+' | rg -i "openai|anthropic|\.generativeai|new Agent|crewai|langgraph" || true)
REGISTRY_TOUCHED=$(git diff --name-only origin/main... | rg -c 'agents\.yaml' || true)

if [ -n "$NEW_CALLS" ] && [ "${REGISTRY_TOUCHED:-0}" -eq 0 ]; then
  echo "New model/agent code detected but agents.yaml was not updated."
  echo "Add the agent to the registry (owner, tools, data_scope, kill) before merging."
  exit 1
fi

It's crude on purpose. The point isn't perfect detection — it's that adding an agent and updating the list become the same commit, the way a lockfile or a license manifest stays honest. That single gate is the difference between an inventory that's true and a document that was true once.

The payoff#

Three steps, an afternoon, zero new vendors: a list that always knows what's running, an owner for each thing that can act, and a kill switch you can hit in under a minute. That's the founder-scale version of a nine-figure security thesis. And when you eventually do want spend limits and rate caps on top of it, the registry is the map you'll route them through — start with spend caps and rate limits once you know what you're capping. Build the list first. Everything else in agent security is a layer on top of knowing what you have.