Deckard

Deckard is Arthur's open-source agent discovery scanner.

Scan your endpoints, cloud, network logs and SIEM for shadow agents, and track them in your SIEM.

Deckard scans your systems (cloud AI platforms, endpoints, network logs and
your SIEM) for AI agents, and sends every one it finds to Elasticsearch, Splunk, your SIEM or any
webhook. It's headless, read-only, and runs entirely in your environment.

Quickstart

Find the AI agents on your own machine in a couple of minutes, with no accounts or
credentials. You need Docker with Compose 2.24 or later, and
osquery (brew install --cask osquery on a Mac).

Set up with a coding agent

Paste this into Claude Code, Cursor, OpenAI Codex CLI or any other coding agent on your machine:

Download https://raw.githubusercontent.com/arthur-ai/deckard/main/docs/agent-setup/prompt.md with curl, read all of it, and follow its instructions to set up Arthur Deckard on this machine.

The coding agent checks your machine first. If something needs installing, or a step needs
administrator rights (sudo), it stops and tells you the command to run yourself. Then it
runs the same steps as Or by hand below, shows you the agents it found, and can walk you through adding a cloud,
MDM or SIEM source and your own destination. The
prompt never tells
the agent to run sudo. It is plain Markdown, so you can read it before you paste it.

Or by hand

git clone https://github.com/arthur-ai/deckard.git
cd deckard/docker-compose
./scan-local.sh
docker compose up -d --wait

scan-local.sh lists what's installed on this machine using the osquery queries from
ai-detection-spec, our open format and
catalog for finding AI agents on a machine. It changes nothing and doesn't need root. Run it
before docker compose up: it writes the folder that Compose mounts into Deckard's container,
so the first scan has something to read. Deckard re-reads the folder on every scan, so run
scan-local.sh again whenever you want to refresh it.

docker compose up starts Deckard together with a local Elasticsearch and Kibana. Deckard
matches what it finds against the catalog and sends each agent to that Elasticsearch, within
a minute of starting. On first start, Compose also creates a saved Kibana search called
Deckard findings: open
Deckard findings in Kibana, log
in as elastic with password changeme, and it lists every event Deckard sent: one per
agent found and one per scan, over the last 30 days. Expand a row to see the whole event.

🚧

changeme is the default password for this local quickstart only. Set

ELASTIC_PASSWORD in docker-compose/.env to change it, and never expose this
Elasticsearch outside your machine.

Or ask Elasticsearch from the terminal:

curl -s -u elastic:changeme 'localhost:9200/_query?format=txt' \
  -H 'Content-Type: application/json' \
  -d '{"query": "FROM logs-arthur.discovery-* | WHERE event_type == \"arthur.discovery.agent\" | KEEP @timestamp, agent.name, source.name | SORT @timestamp DESC"}'

       @timestamp       |   agent.name   |  source.name
------------------------+----------------+---------------
2026-10-26T21:06:33.120Z|Claude Code     |this-machine
2026-10-26T21:06:33.120Z|Claude Desktop  |this-machine
2026-10-26T21:06:33.120Z|Cursor          |this-machine
...

Next, add your cloud, MDM (mobile device management) or SIEM sources to
docker-compose/discovery.yaml (it has commented
examples), and point its destination at your own Elasticsearch, Splunk or webhook. Deckard
reads the file only when its container starts, so apply each change with
docker compose up -d --force-recreate deckard. See
docker-compose/ for more.

Deploy on Kubernetes

Write your config as discovery.yaml first (start from the Docker Compose one), then:

kubectl create namespace deckard
kubectl -n deckard create secret generic deckard-credentials \
  --from-literal=SPLUNK_HEC_TOKEN="$SPLUNK_HEC_TOKEN"

helm install deckard oci://ghcr.io/arthur-ai/charts/deckard -n deckard --set-file config=discovery.yaml

In discovery.yaml, refer to each key in the Secret by its name, as ${NAME}: for the
Secret above, ${SPLUNK_HEC_TOKEN}. See the
chart's README for the details and cloud workload identity.

To deploy with plain Kubernetes manifests instead of Helm, see Run Deckard on Kubernetes.

Each release publishes the image
arthurplatform/deckard on Docker Hub, which the chart pulls by default, and the chart on
GHCR (ghcr.io/arthur-ai/charts/deckard), at the same version; add --version to pin one.

Integrations

Destinations: Elasticsearch and Elastic Security, Splunk HTTP Event Collector, or any
HTTPS webhook.

Each integration's fields and permissions, and what's coming soon, are on Agent Discovery Integrations.

Missing one you use? Open an issue.

Documentation

• How Deckard works: discovery classes, sources and scans
• Events and alerting: what your SIEM receives and what to alert on
• Configuration reference:
  every source's fields and permissions, destination options, scheduling. It lives in the
  Arthur Engine repository, because Deckard runs the Arthur Engine (see
  Deckard and the Arthur Engine).