Original Reddit post

“AI” comes in many forms. Just some of them are:

1. Coding agents used by developers (sanctioned or non-sanctioned)
2. MCPs attached to Claude Desktop or ChatGPT
3. Any piece of code that calls an LLM directly, or indirectly (say via a framework or LiteLLM)
4. Any piece of code that uses an LLM to direct its behavior - the Agentic AI we are familiar with
5. Apps that leverage AWS Bedrock or Azure AI Foundry for their AI requirements
6. Users that use apps that use AI at the backend (pretty much every SaaS out there) And so on and so forth. So securing it can’t begin until we first identify it. To solve this problem, we need to determine AI from multiple sources of signals - IDPs like Google Workspace or Microsoft Entra, AWS, Azure and Gemini logs that reflect AI activity, code repos (Github and Azure Repos), etc. to determine what your AI estate looks like. This open-source project I have built, does all this and then categorizes these into three buckets A. AI Resources - AI agents, AI applications, Guardrails, MCP servers, etc. B. AI Supporting Resources - Cloud Resources, Code Repos, Identities C. SCA - using open-source scanners we break down the entire supply chain of your AI estate The coolest part I think is the Code to Cloud story that emerges. Which “AI powered code” runs in which cloud resource, assumes which identity, calls which models, and has what blast radius. Denali is released under Apache License 2.0 Would love for the community to try it out, critique it, and help improve it. submitted by /u/AnswerPositive6598

Originally posted by u/AnswerPositive6598 on r/ArtificialInteligence