[Shivam Sharma (ShivamSharma43)]

Related Issue

None. This is a bug I found in agent_discovery.scanners.config.ConfigScanner; the sections below are filled in as the template asks.

Problem & Solution

Problem. When a Dockerfile or Compose file matches one of DOCKER_AGENT_PATTERNS, the scanner uses the matched text as the agent type:

agent_type=match.group(0).lower(),

The other scanners report a fixed type per framework (langchain, agt, mcp-server, semantic-kernel, ...), and RiskScorer and Reconciler compare against those names. A container therefore gets whatever spelling its file happened to use:

Dockerfile line	type on main	type the process scanner reports
RUN pip install langgraph	langgraph	langchain
RUN pip install agent_governance	agent_governance	agt
CMD python -m my_mcp_server	mcp_server	mcp-server
RUN pip install semantic_kernel	semantic_kernel	semantic-kernel

The effects:

• RiskScorer adds no type factor: a langgraph container misses the +15 high-risk score, and a semantic_kernel container misses the +10 medium-risk score.
• Reconciler never recommends running mcp-scan for an mcp_server container, because it checks agent_type == "mcp-server".
• AgentInventory.search(agent_type=...) and the by_type counts in agent-discovery inventory -o summary split one framework across several spellings.

Solution. Each entry in DOCKER_AGENT_PATTERNS now pairs the regex with the type it reports, using the same names as the process scanner. The fingerprint still uses the pattern text, so agents already in a saved inventory keep their fingerprints and merge with new scans as before.

Impact on Your Work

agent-discovery reconcile ranks shadow agents by risk score. Before this fix, containerized agents could rank lower than they should, depending on how their Dockerfile spelled the framework name.

Timeline

None.

Alternatives Considered

• Normalize the matched text (lowercase, _ → -). That fixes mcp_server and semantic_kernel, but langgraph and agent_governance still don't map to langchain and agt. An explicit type per pattern is simpler and matches how the process and GitHub scanners do it.
• Change the fingerprint to use the type. That would give every container agent already in a saved inventory a new fingerprint, and the next scan would create duplicates. It isn't needed for this fix.

Type of Change

• Bug fix (non-breaking change that fixes an issue)

Package(s) Affected

Governance & security:

• agent-discovery

Testing

Unit Testing

New tests/test_config_scanner.py:

• test_reports_the_canonical_agent_type, parametrized over a Dockerfile line for each pattern (langgraph, LangChain, crewai, autogen-agentchat, agent_governance, my_mcp_server, semantic_kernel). Each reports the process scanner's type.
• test_container_agent_type_drives_risk_scoring: a semantic_kernel container gets the Medium-risk agent type: semantic-kernel factor.
• test_fingerprint_keeps_the_matched_pattern: the merge key is still the pattern text.

The langgraph, agent_governance, my_mcp_server and semantic_kernel cases and the risk-scoring test fail on main.

Manual Testing

• agent-discovery/tests: 66 passed.
• scripts/check_license_headers.py on the changed files: clean.
• ruff check and ruff format --check: clean.
• Spell check: ran cspell with .cspell.json on the added lines; no issues.

Checklist

• I have linked a related issue above, or completed "Problem & Solution", "Impact on Your Work", and "Alternatives Considered"
• My code follows the project style guidelines (ruff check)
• I have added tests that prove my fix/feature works
• All new and existing tests pass (pytest)
• I have updated documentation as needed (CHANGELOG)
• I have signed the Microsoft CLA

Attribution & Prior Art

• This contribution does not contain code copied or derived from other projects without attribution
• Any external projects that inspired this design are credited in code comments or documentation
• If this PR implements functionality similar to an existing open-source project, I have listed it below

None.

AI Assistance

• I can explain every meaningful change in this PR: what it does, why, and what tradeoffs were considered
• I have run tests and verification appropriate for this change
• No part of this PR was autonomously submitted by an AI agent without my review
• I have not used AI to generate review comments on others' PRs

I used Claude Code (Claude Opus) to help find the bug and draft the fix and tests. I reviewed the full diff and will handle review comments myself.

IP, Patents, and Licensing

• This contribution does not implement patent-pending or patent-encumbered techniques
• This contribution does not require an NDA or licensing agreement to understand or use
• Any AI tools used have terms compatible with the MIT License

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[github-actions]

PR Review Summary

Check	Status	Details
🔍 Code Review	⚠️ Missing	No current-run comment
🛡️ Security Scan	⚠️ Missing	No current-run comment
🔄 Breaking Changes	⚠️ Missing	No current-run comment
📝 Docs Sync	⚠️ Missing	No current-run comment
🧪 Test Coverage	⚠️ Missing	No current-run comment

Verdict: ⚠️ AI review incomplete; ready for human review

AI review comments are untrusted advisory output. The summary reports workflow-generated completion status only, not model-authored pass/fail claims.

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AGT Contributor Check.

[MohammadHaroonAbuomar]

• Verified: on main the container scanner set agent_type to the raw matched text, so a Docker or Compose agent was typed langgraph, mcp_server or semantic_kernel and never matched the fixed names the risk rules, the reconciler and the inventory counts compare against. Pairing each pattern with its canonical type fixes that, the fingerprint and merge keys still use the pattern text so saved inventories keep merging, and detection and confidence are unchanged. Five of the nine tests fail on main and pass here; the package suite passes (66); lint and spelling are clean.

One item blocks merge: the new file agent-governance-python/agent-discovery/tests/test_config_scanner.py has no Microsoft license header, and both license-header checks fail on it. Please add the two header lines at the top (scripts/check_license_headers.py --fix does it) and keep the sign-off on the amended commit.

Housekeeping: #4367 and this PR add a changelog bullet at the same spot, and #4325 edits the same block of config.py, so whichever lands second will need a small rebase.

[Shivam Sharma (ShivamSharma43)]

MohammadHaroonAbuomar thanks. Added the license header to tests/test_config_scanner.py and amended with the sign-off kept: 0cb5f25. scripts/check_license_headers.py is clean on the changed files and the package suite still passes (66). Noted on the rebase with #4367 / #4325.

Addressed on 0cb5f25: the new test file now carries the Microsoft license header and the header check passes; the source and changelog changes are unchanged from the head I reviewed. Package suite passes (66), lint and spelling clean. Nothing left to fix; I will approve and merge once the gated checks on this head are green, after #4367 or before it depending on which lands first.

[MohammadHaroonAbuomar]

Verified the fix in code and ran the tests locally; CI is green on the current head.