Google Cloud Compute Engine
Vendor key: gcp_compute_engine. For how source fields and scan configs fit together, see Agent Discovery Integrations.
Discovers agentic coding tools, local agents, AI browsers and browser extensions installed on your Compute Engine VMs. The Arthur discovery collector runs on each VM and writes its results to the VM's guest attributes, and Arthur reads them through the Compute Engine API.
Before you start
- Deploy the Arthur discovery collector to your VMs. It runs on a schedule through an OS policy.
- Enable guest attributes by setting the metadata key
enable-guest-attributes=TRUEon each VM or on its project. Arthur reports VMs without it asguest-attributes-disabledand doesn't read them.
For step-by-step instructions, see the Compute Engine setup guide.
Source fields
| Field | Required | Sensitive | Default | Description |
|---|---|---|---|---|
project_ids | Yes | No | Comma-separated GCP project IDs to scan, for example prod-fleet,dev-fleet. | |
include_labels | No | No | All VMs | Comma-separated key=value VM labels. Only VMs with at least one of these labels are scanned. |
exclude_labels | No | No | None | Comma-separated key=value VM labels. VMs with any of these labels are skipped. If a VM matches both lists, it's excluded. |
service_account_key | Yes* | Yes | The full JSON key of a GCP service account. |
* Required unless your Arthur engine runs on GCP and has been configured to use its own Application Default Credentials (ARTHUR_ENGINE_GCP_COMPUTE_ENGINE_ALLOW_ADC=true).
Label matching is exact. If no VM has a label in your selectors, the scan logs a warning and continues; it doesn't fail.
Scan config
| Setting | Value |
|---|---|
query | "" to use Arthur's built-in agent catalog, or your own catalog YAML. |
query_language | none |
lookback_window_seconds | Arthur lists every VM on every scan. VMs whose collector hasn't reported within this window are counted as not-reported-in-window and their results aren't published. 0 publishes every VM's most recent report. |
Required permissions
compute.instances.listcompute.instances.getGuestAttributescompute.projects.get. Needed only when guest attributes are enabled at the project level rather than on each VM.
The predefined role roles/compute.viewer includes all three.
Updated 33 minutes ago