The full inventory of what an agent is built from: its harness, the MCP servers it calls, its skills, plugins, tools, and packages, plus the identity it runs under. Shortened to agent BOM.
audit mode
A control that records what it would have blocked, without blocking it. Every control ships in audit mode, and you move them to enforce one at a time.
B
blast radius
What one compromised agent can reach: the repositories, packages, internal APIs, secrets, and downstream MCP servers the compromised asset can touch. Computed as a traversal of the context graph Metano already holds, not an estimate, so every edge is walkable and checkable.
C
chained action
A sequence where every step is permitted and the outcome is not. A maintenance agent asks a payroll agent for records, and gets them. Nothing that inspects agents one at a time sees it.
context graph
The joined record of identity, environment, and action for every agent. Badge, room, and work have always been three systems that never spoke. Joining them is what lets you ask why.
E
enforce mode
A control that stops the action instead of logging it. You turn enforce on per control, after audit mode has shown you what it catches, and you can turn it back off.
G
generated events
Records Metano writes itself instead of reading logs the environment already keeps. Those logs were built for other questions, which is why they cannot say why an action happened.
H
harness
The runtime an agent executes inside. One of the six object types in an agent bill of materials, and the layer most inventories never open.
Hive
Metano’s intelligence layer. Hive writes each agent’s runtime guardrails from its own spec or observed behavior, builds an organizational memory of your agents, teams, and patterns, and its recommendations get smarter over time. Three layers: deterministic rules, purpose-built small models, and a mesh of models for verdicts.
I
intent
What an agent was built to do, read from its own spec rather than guessed from its traffic. Intent is what makes an out-of-scope action visible when every log says it was permitted.
K
kill switch
A control that pauses an agent, a team, or the fleet mid-action. Duration-bounded, with a preview of exactly what a given selection will stop before you pull it.
M
MCP server
A Model Context Protocol server an agent calls out to for tools or data. Each one extends what the agent can reach, so an unregistered server is a reach nobody approved.
N
non-human identity
The credential an agent acts under, usually issued to whoever created it. It is why an agent can reach everything its author can reach, and why no org chart ever recorded it.
P
policy library
A language for writing your own agent rules, plus a job maintaining them forever. One company reached 65,000 rules with nobody left who could explain what they were for. Metano writes the rules and hands you a shortlist to approve.
R
runtime guardrails
Controls that evaluate an agent’s actions while it runs, rather than rules checked before it ships. They are called runtime guardrails because the timing is the whole point.
S
shadow AI
Agents and agent components running in your organization that nobody registered. Metano reads it wider than most: unrecognized MCP servers, tool calls, and installed packages count, alongside whole agents.
skill
A packaged capability an agent loads to do a task. Skills get installed and shared and rarely reviewed, so a vetted agent can still be running code nobody read.
SkillTracer
A scanner that reads a skill and reports what it does. No account and no sales call, because a claim you can test is worth more than a claim you have to believe.
surfaces
The places agents actually run: the endpoint, custom agents, the cloud platform, and SaaS tools. A control that covers one surface leaves the others unwatched.
T
the six object types
Harnesses, MCP servers, skills, plugins, tools, and packages. The six things an agent is assembled from, and the depth an agent bill of materials has to reach to be worth having.