Review endpoint agents and MCP servers

Investigate endpoint AI agent activity. Find which endpoints are running a given AI agent, and see the MCP servers it connects to.

Before you begin

  • You have the super admin role.

  • Connect CrowdStrike Falcon to ISPM. See CrowdStrike Falcon.

Procedure

  1. In the ISPM console, go to Inventory > AI agents.
  2. Open the Endpoint agents page to review the AI agents running on endpoints and the MCP servers they connect to.
  3. Select an AI agent to see its details and its MCP servers.
  4. Open the MCP Servers page to review MCP servers and the AI agents connected to each one.
  5. Select a server to see its linked AI agents and endpoint users.
  6. Export an inventory as CSV to keep a point-in-time snapshot.