New fleetd table: ai_tools - #47641
Merged
Merged
Conversation
Add documentation for the ai_tools osquery extension table provided by karmine05/agentic-detector. This table surfaces AI tools on the host including MCP servers, AI agent CLIs, AI desktop apps, IDE plugins, live AI/MCP network sockets, and agent instruction files.
noahtalerman
changed the title
ai_tools
rachaelshaw
approved these changes
Jun 15, 2026
…d-ai-tools-table Merge in upstream changes.
7 tasks
dantecatalfamo
added a commit
that referenced
this pull request
Jul 14, 2026
Pulls the ai_tools schema documentation from #47641 into this PR so the table is documented alongside the code, and reconciles it with what the extension actually ships: - discriminator column stays `type` (matches the code and #47641's own YAML, despite that PR's description saying `kind`); - adds the `browser_extension` row type, which the vendored collectors emit but the original doc omitted; - lists the full set of risk_flags the collectors produce. Regenerated schema/osquery_fleet_schema.json via `cd website && ./node_modules/sails/bin/sails.js run generate-merged-schema`.
2 tasks
rachaelshaw
pushed a commit
that referenced
this pull request
Jul 15, 2026
**Related issue:** Resolves #47619 (docs reconciliation) Updates the `ai_tools` table schema doc so it matches the extension actually shipped in fleetd. The doc (originally #47641) was generated from a pre-v0.3.0 snapshot of `karmine05/agentic-detector` and predates two things that landed in v0.3.0 — the version vendored into fleetd in #49243: - the **`browser_extension`** row type (added upstream *after* the doc was written); - several **`risk_flags`** the collectors emit. ### Changes - Add `browser_extension` to the `type` column options, the table description, and a new example query. - List the full set of 15 `risk_flags` the collectors produce (was 8). - Regenerate `schema/osquery_fleet_schema.json` via `cd website && ./node_modules/sails/bin/sails.js run generate-merged-schema`. This brings the published schema in line with the vendored code in #49243 (which ships 7 row types and 15 risk flags). No other tables are touched. # Checklist for submitter - [x] Documentation updated to match shipped behavior (schema table doc). - [x] Regenerated `schema/osquery_fleet_schema.json` (the automated-doc CI check runs the same generator).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ai_tools#47619Summary
schema/tables/ai_tools.ymldocumenting theai_toolsosquery extension table from karmine05/agentic-detector.Details
The
ai_toolstable is provided by the agentic-detector osquery extension and uses a single unified schema with akinddiscriminator column covering six row types:mcp_server,ide_plugins,agents,apps,sockets, andagent_instruction. Each row carries security posture viarisk_flagsand asha256content fingerprint.Built for Noah Talerman by Kilo for Slack