Skip to content
Northbeams Labs

Tool

agentsurface

A local inventory of the agent machinery installed on a machine. It answers one question: what agent software is on this computer, and who published it.

Status
In development. Source public, no tagged release yet.
Published by
Northbeams Labs
Runs
Locally, on macOS, Linux and Windows

What it inventories

  • MCP servers, across every client it can find rather than a few fixed paths. User scope and project scope, on macOS, Linux and Windows.
  • Desktop extensions, plugins, marketplace plugins, skills, connectors and scheduled agent tasks.
  • Instruction files. The full set, not one vendor’s.
  • AI-aware browser extensions. Browser profiles are enumerated locally and the extensions found are matched against the catalogue Northbeams maintains.
  • Tool-description drift. It keeps a local baseline of tool names and descriptions, hashed, so a later run can flag a definition that changed under you.
  • Named findings. Each item says what it is, who published it, and what it can reach.

What this does not do

These are refusals, not defaults. They are not settings, and there is no flag that turns any of them on.

  • No network calls of any kind. Not for updates, not for catalogue lookups, not for anything.
  • No account, no sign-in, no token.
  • No upload. Findings stay on the machine that produced them. Nothing is sent to Northbeams or anyone else.
  • No telemetry and no lead capture. No email address is asked for at any point.
  • No model calls. Nothing is sent to a language model, including tool names and descriptions.

This is enforced rather than promised: a build check fails the release if the binary imports the network library.

What it does not detect

Written before the code, so the limits are not something you discover afterwards.

  • It inventories what is installed. It does not judge whether any of it is malicious.
  • It does not detect prompt injection, and does not pretend to.
  • It reads local files only. Anything running purely in a cloud account is invisible to it.
  • Catalogue matching is only as fresh as the snapshot compiled into the binary you are running.

What it prints

  • A readable summary in the terminal, by default.
  • --json for machine-readable output.
  • An explicit list of what the run did not look at, in every run.
  • No risk score. A score we cannot defend line by line is a claim, and claims without data are the thing this imprint exists not to make.

Installing

The Go command works today, straight from source. The Homebrew tap does not exist yet and is recorded here so the install path at release is the one written now.

brew install northbeams-labs/tap/agentsurface
go install github.com/Northbeams-Labs/agentsurface/cmd/agentsurface@latest

Neither command needs an account, and neither one registers anything with us. Installing from source means you are running code you can read first, which is the point.

Not in the first version

Reasonable to add later, deliberately absent now:

  • SARIF output.
  • CVE lookup.
  • A signed local receipt of a run.