What’s in an
AI agent?
The agent constellation: why an agent is many parts, and why you inventory them as one unit.
Joshua Marpet and Cairn Viktor
You approved an agent.
Do you know what code it is running?
Most people would answer with the name of the model. That is one star. The agent you run today also depends on a harness, prompts, tools, plugins, memory, credentials and other agents, and any of them can change without anyone telling you.
“Security tooling that targets the model alone is like cooking Thanksgiving dinner and only having cranberry sauce. Incomplete!”
From The Agent Manifest and Agent Reconciliation, VCRI method note, Joshua Marpet and Cairn Viktor, September 2026.
Eight stars, one agent
Which model, which exact version or snapshot.
The agent framework that runs the loop and calls the model.
The standing instructions, plus templates and policy packs.
What it can call. MCP, the Model Context Protocol, connects agents to tools.
Add-ons and skills it loads, usually from a marketplace.
What it remembers between runs: vector stores, files, databases.
The accounts and keys it holds, and what each can reach.
The agents it calls, trusts, or hands work to.
Change one part and the agent changes
| What changed | What it looks like |
|---|---|
| Model | The provider repoints a version alias to a new snapshot. Same name, different model. |
| Tool or MCP server | A tool’s definition changes after you approved it, or a version pin quietly moves. |
| Plugin | The agent installs something other than the pinned version, and reports the pinned one. |
| Credentials | A scope is wider than declared, or the agent holds a key it should not. |
| Memory or agents | A memory store it was never granted, or a new agent it now talks to. |
Inventory the whole constellation, together
- Approval should bind to the whole set, not to a model name. The agent is the combination.
- Parts change on different schedules and by different owners: the provider, the vendor, your own team.
- An inventory that misses a component looks complete. That is why discovery and an accountable owner matter.
- Once you have one list, you can compare it to next month’s list. The difference is drift.
Know how you know
Every line of the inventory says which kind of evidence stands behind it.
The tool hashed the bytes on disk, or read the entry from a configuration file.
Example: a plugin directory, a system prompt file, an MCP server entry in your client config.
Someone typed it in and nothing on disk was checked.
Example: a hosted model. Its weights are not on your disk, so its version is always stated.
The AIBOM Constellation Inventory
Lists everything an agent depends on, with versions and content hashes.
Writes the list as a CycloneDX 1.6 AIBOM (AI Bill of Materials), an open format other tools read.
One Python file, standard library only. No network access. Runs no other programs.
Never writes secret values. Credentials are recorded as a name and a scope.
It does not score, rate or judge anything. It records what is there.
Open source, Apache-2.0.
Four commands
Write the list, build the AIBOM, check for gaps, and compare against last time.
You Don’t Know What
Code You’re Running
A Security Weekly short with Joshua Marpet on the agent constellation: the model, MCP servers, plugins, prompts, memory and tools an AI agent depends on. Find it at valuechainrisk.org/media.
Inventory one agent
- Pick one agent your team runs. Write down all eight stars, even the ones you have to guess.
- Mark each line observed or stated. Chase the stated ones that matter most.
- Run the Constellation Inventory, save the output, and run diff against it next month.
- Ask each AI vendor you buy from: can you give us the constellation of the agent you run for us?
Free to use, teach and share.
This deck is part of the VCRI Learn series. Use it in your class, your team meeting or your chapter, with credit to The Value Chain Risk Institute.
valuechainrisk.org/learn