unbound discover scans a device for installed AI coding tools and reports findings to Unbound. This powers the AI Tools inventory and fleet visibility in the dashboard.
Tools detected: Cursor and Cursor CLI, Claude Code, Claude Cowork, Claude Desktop, GitHub Copilot (VS Code, CLI, app and Xcode), Visual Studio, Xcode Coding Intelligence, Gemini CLI, Codex, Devin Desktop, Roo Code, Cline, Kilo Code, OpenCode, Replit, JetBrains IDEs, Junie, Augment Code, Google Antigravity, OpenClaw, Pi Coding Agent, Zed, and more.
Prerequisites
Python 3 must be available on the device — the installer acceptspython3, python, or py -3 on Windows. It downloads its files with Git when Git is available; the fallback needs curl and tar on macOS and Linux, and nothing extra on Windows.
Which key you pass to --api-key depends on the scan’s scope:
- Single-user scan (no
sudo) — use your own user API key. - All-users scan (with
sudo) — scans every user’s account on the device. Withsudo unbound discover, the device is attributed to whoever owns the key you pass, so an admin key makes the admin the owner. To attribute each device to its real owner across a fleet, usesudo unbound onboard, which resolves the owner from the device’s hardware serial.
Run a scan
Discovery stops on its own after 200 minutes if it can't finish. before it starts; a scan that reaches that limit stops, exits non-zero, and shows as a failed run in Unbound.
Discovery supports macOS, Windows and Linux. On any other operating system the scan is skipped, the command prints AI tool discovery is not supported on this operating system. Skipping the scan — the Unbound CLI works normally. and still exits 0. A fleet script that only checks exit codes will read those devices as successes, so confirm coverage in the dashboard’s AI Tools inventory rather than from exit codes alone.
Schedule recurring scans
A device that Unbound is already set up on keeps itself current: opening an agent session triggers a scan, at most once every 24 hours per user account. That is why Last Sync keeps moving on machines with no schedule of their own. Scheduling below is for devices you want scanned on a fixed clock whether or not anyone is working — a fleet baseline rather than a requirement.
The API key the scheduled scan runs with is stored on the device — in the platform’s secret store on macOS and Windows, and in a protected file in your home directory on Linux.
unbound discover unschedule removes the schedule and that credential together.
Check schedule status and log paths:
discover status reports the schedule on macOS. On Linux and Windows it exits with an error naming the command to run instead.One-step user onboarding
unbound onboard combines tool setup and discovery into a single command — useful for scripting new user enrollment:
sudo the bundle is Cursor, Claude Code, Codex, Copilot and Augment Code; with sudo it additionally includes Gemini CLI.
Onboard flags
MDM device onboarding (admin, requires root)
For fleet-wide enrollment from an MDM system:unbound onboard with sudo configures every user on the device (MDM/org scope), without sudo just the current user. The device scan it finishes with follows the same scope.
See MDM Integrations for deployment guides and MDM-specific configuration.
What a scan collects
Never sent. Environment variable values and request headers from MCP server configuration never leave the device. A server’s address, by contrast, is reported exactly as configured — so keep its credentials in
env or headers, not inside the URL.
What gets read. Only each tool’s own configuration, rules and skill files — CLAUDE.md, .cursorrules, SKILL.md and their equivalents. The rest of a project is never opened. The one exception is the MCP row above: a server configured to run a script on the machine has that script reported in full. Treat a script an agent launches as reviewable, not private.
Each run also reports diagnostics about itself — how long it took, how many tools it found, the operating system and Python version.
Stays local. Nothing the scan keeps in ~/.unbound/ on the device is uploaded. A report that cannot be delivered is held there and sent by the next scan; if it is still undelivered after 24 hours it is dropped, so a device offline for longer than that leaves a gap in the inventory rather than a late entry.
Supported AI coding tools
Coverage continues to evolve alongside the AI tooling ecosystem. Specific feature behavior may vary by tool version and deployment configuration.
Xcode Coding Intelligence is reported only once the coding assistant has been configured. An Xcode install on its own is not counted as an AI tool.
A scan from your MDM does not list the tools of servers that run locally on a developer’s machine — those are inventoried with an empty list. A developer’s own scan lists them in full, so expect the two to differ.
.cursorrules, CLAUDE.md, GEMINI.md, .windsurfrules).
Skills — The SKILL.md instruction bundles an agent adds to its toolkit and uses when relevant. Their contents are captured, not just their names, so you can review what a skill actually tells the agent to do. For the tools that support them, this also covers the custom slash commands and subagent definitions a developer has installed.
Permissions — For Claude Code, Cursor, Cursor CLI, GitHub Copilot, GitHub Copilot CLI, GitHub Copilot for Xcode (macOS) and Augment Code, Discovery also reports the allow, deny and ask rules each developer has in place — what the agent may run, edit or reach without stopping to ask.
Plugins — For Claude Code and Cursor, Discovery inventories the plugins each developer has installed, where each came from, and whether it is on the tool’s own blocklist. Skills that arrive bundled inside a plugin are reported with that origin attached.
MDM Integrations
Connect your MDM provider and deploy AI tools at scale
Analytics
View discovered tools and fleet activity in the dashboard