AI Discovery
Inventory First
Before you set any policy, Cerbera AI builds an inventory of the AI in use across your fleet, called the AI Registry. The first wave of value is simply visibility: knowing which AI providers, applications, and MCP servers your people use, and in what proportion.
Cerbera maintains the catalog of what it can detect, and keeps it current as new tools appear. When usage is found, it is surfaced so you can see who uses what.
What the Registry Covers
The registry is organized into six views:
| View | What it shows |
|---|---|
| Providers | The AI providers reached (for example Claude, ChatGPT, Gemini), across browser, desktop, and CLI usage. |
| Applications | The client applications and processes making those calls. |
| MCP servers | Every MCP server connected to, with a risk score for each. See MCP Governance. |
| Packages | Packages downloaded by agents, part of the supply-chain picture. |
| Users | Per-person usage, drillable into everything that person touched. |
| Sessions | Individual AI interaction sessions. |
Each row drills into a detail view: for example a specific provider's usage across the fleet, or a specific MCP server's clients, users, and tool-call volume.
MCP Visibility
MCP gets its own view within the registry, with a risk score per server: a server maintained directly by a well-known provider (for example Slack's own MCP server) scores lower risk than a third-party or community wrapper around a vendor's API, maintained by unknown parties, that users frequently connect to and hand over API keys or tokens to.
The dashboard shows how people connect to each server, its risk band, and volume of tool calls, so you can decide what to allow or block. For full rule mechanics, see MCP Governance.
From Discovery to Policy
Discovery feeds directly into your rules. A typical path:
Monitor
Run silently for a few weeks to learn what is actually in use.
Review
Look at the registry across providers, applications, MCP servers, and packages, and the risk scores and alerts Cerbera surfaces.
Decide
Write allow rules for sanctioned providers and servers, and block rules for the ones you do not want.
Enforce
Tighten toward block-by-default for the categories you have catalogued the bulk of legitimate usage for.