Run This Agent Containment Checklist Before Production: Inventory, Permissions, Drift Alarms, and Incident Response
Treat local agent inventory and permission visibility as a containment control before production, not as a post-incident audit.
Inventory is the first containment control
An agent that can read a file, call a tool, or write a log is a process with access. Before that process enters production, the operator needs to know its access surface. Local agent inventory is the first containment control. It gives the operator local agent observability before the first production request, not after the first bad write.
Geiger, a scanner published by Atomburst, is a useful reference point for the shape of the control. The license is MIT, and the tool ships without runtime dependencies. It performs one read-only pass. It inventories agent, MCP server, plugin, and extension surfaces, then states what each can access. MCP servers, which connect agents to external tools, are one of the surfaces an operator must see.
The scan should not modify files. It should produce a list the operator can use for agent security review. The output should be comparable against later scans. If the tool needs extra runtime, the operator should note that as part of the machine state.
The scale is visible in the ecosystem. An open-source agent harness gained more than 200,000 GitHub stars in three weeks during August 2026. The plugin ecosystem passed 13,000 repositories during the same period. A redacted scan of a real machine produced 9 findings across 3 ecosystems, including 7 components that could execute code and 1 credential in config files.
Run the pre-production checklist
The checklist below is the minimum. Each item is a check, not a project. It should be possible to run the whole pass before the agent receives production traffic.
- Run an inventory scan on the production host.
- Record every agent, MCP server, plugin, and extension it finds.
- Mark each component that can execute code.
- Record where credentials appear in config files.
- Confirm the scan path covers every repository the agent can touch.
- Verify the drift alarm watches every repository the agent can touch.
- Name the operator who owns the first response.
- Write the rollback step that stops the agent without deleting evidence.
The list is short on purpose. A longer checklist becomes a project. A short checklist stays runnable. The operator can rerun it after every dependency update, every new extension, and every change to the agent's tool access. The output should support AI agent monitoring, not just a one-time audit.
The inventory items exist because an unseen component is an uncontrolled permission. The path items exist because a missed repository is not watched. The response items exist because the operator needs a named owner, a stop step, and a record before the incident.
Drift alarms fail when paths are narrow
A drift alarm is only as good as its path. In a test, Geiger identified 14 of 19 planted agent surfaces when pointed at a home directory. The same test found 17 of 19 when the scan path included three repositories. The recommended drift alarm reported no change when a new MCP server appeared in a repository outside the scan path. The known-agents data file is 1,265 bytes, and it lists 13 identifiers for VS Code extensions, 7 npm package names, and 18 name fragments for browser extensions.
That gap matters because agents are not static. A new server, plugin, or extension can appear in a repository the operator already trusts. If the alarm does not watch that repository, the change is invisible. The operator should include path coverage in the alarm design.
Incident response starts before the incident
When an agent misbehaves, the first action should be to stop its access, not to explain it. The operator needs a named owner, a stop step, and a record of what changed. That record should include the inventory snapshot, the permission list, and the drift alarm state.
If the machine is shared, the response should preserve enough state for a later audit. If the machine is local, the response should still assume the agent may have accessed more than the task asked for. The incident record should also note which user account ran the agent, which directories it could reach, and which external tools it could call. That detail narrows the investigation. The checklist is agent ops before the agent ships. The operator should keep the checklist with the agent's deployment record.