Desktop Apps & CLI Tools
The Desktop Apps and CLI Tools tabs under Discover AI > AI Tools list the desktop AI apps and command-line AI tools that the macOS and Windows desktop agents detect. Only tools in the Tool Registry are detected.
These tabs need the desktop agent on your devices. See Deploying Agents & Extensions. Viewing them requires the AI Tools inventory permission.
How the agent detects tools
- Running apps and processes: the agent matches running apps and processes against the registry by app bundle ID (macOS), or by executable name, app ID or command-line match (Windows).
- Foreground time: for desktop apps, how long the app is in the foreground.
- Local session files: for supported tools, the agent reads prompt counts, tool-call counts, token counts and the model from the tool's own local session files. Prompt text is not sent.
- Prompt counts in chat apps: from the composer's send button on Windows, or from the length of the input text on macOS. The text itself is never read.
The full list of supported tools and what each platform reads is on Deploying Agents & Extensions.
Desktop Apps tab
Desktop and IDE AI apps such as Cursor, Windsurf, Claude and ChatGPT.
| Column | Meaning |
|---|---|
| App Name | The tool, with its logo. |
| Risk, Sanction | The tool's risk level and your sanction status. |
| Source | Which agents reported it (macOS, Windows). |
| Users | Distinct people who used it in the period. |
| Sessions | App sessions in the period. |
| Interactions | Prompts sent. |
| Uploads | Files used in the app. Select the count to see the file list. |
| First Seen, Last Active | When the tool was first and last seen. |
Select a row to open the app detail panel. It shows Users, Interactions, Uploads and Sessions, the Models seen, Top users and Recent sessions, and the Sanction and Risk Level controls.
CLI Tools tab
Command-line AI tools such as Claude Code, OpenAI Codex CLI, Gemini CLI, GitHub Copilot CLI and Aider.
The registry also covers Ollama, llm, goose and Cline. The desktop agent detects them from their process and file signatures. They were added as registry entries, so existing agents detect them without an update.
| Column | Meaning |
|---|---|
| CLI Tool | The tool. |
| Source | The client that reported it. |
| Risk, Sanction | Risk level and sanction status. |
| Users, Devices | Distinct people and devices. |
| Sessions | Runs in which real work happened: at least one prompt, tool call or token. A process that started and did nothing is not counted. |
| Interactions | Prompts sent. |
| Tool Calls | Tool calls the AI tool made, such as file reads, edits and shell commands. |
| Tokens | Tokens reported in the tool's local session files. |
| First Seen, Last Active | When the tool was first and last seen. |
Select a row to open the CLI tool detail panel:
- Sessions, Users, Devices and Total time, with a trend that compares the second half of the period with the first half.
- Launcher: where the tool was launched from.
- Version distribution: the exact tool versions seen.
- Identity & footprint: the Executable paths and the Top working directories.
- Subprocess footprint: the top child processes the tool started.
- Top users and Recent sessions. Open a session to see its executable, its command-line arguments, its timing and its prompt count.
- Sanction and Risk Level controls.
Command-line arguments are recorded as typed. If someone passes a prompt as
an argument, for example claude "summarize this file", that text is
included. See Data & Privacy.
Filters
Both tabs share the page filters (AI tools, AI tool categories, OS and Department), the time range, a search box, and the All risk levels and All statuses (sanction) filters.
Developer tool alerts
Developer tool alerts apply your sanction decisions to developer machines. When someone uses an AI coding assistant or command-line AI tool marked Unsanctioned, ANTS alerts the channel you choose. The alerts are off by default.
Open the settings
Go to Settings > Discover AI > Developer tool alerts.
Choose the channel
Pick where alerts go: email, Slack or the policy violation webhook.
Choose the frequency
Choose Each session to alert on every session of an Unsanctioned tool, or Daily digest to receive one summary per day. Developer tools can be busy, so the digest keeps alerts manageable.
Turn it on
Turn on Developer tool alerts and save.
An alert names the tool, the user and the device. It covers the tools on the Desktop Apps and CLI Tools tabs, including IDE assistants such as Cursor, Windsurf and GitHub Copilot, and command-line tools such as Claude Code, Codex CLI and the tools above. A tool nobody has reviewed shows as Unsanctioned, so classify the tools your developers may use before you turn alerts on. See Sanction status.
Changing these settings requires write access to Discover AI configuration, which Owner and Department Admin have by default.
Developer tool alerts notify. They do not stop the tool. Blocking on the endpoint is on the roadmap.
Related
- Understanding the Dashboard
- MCP Server Inventory
- AI Agents: coding agents seen through OpenTelemetry traces
- Coding-Agent Telemetry