Overview

The Swif Agent Inventory Policy finds autonomous AI agents installed on your devices, and reports how each one is set up. These agents can run in the background, act on their own, and run commands on the device, often without IT knowing they're there.

The policy inventories two agents:

Agent	What it is	Platforms
Hermes	Hermes Agent, an open-source autonomous AI agent from Nous Research. It can run continuously in the background, and runs commands directly on the device by default.	macOS, Linux, Windows
Grok Bot	xAI's Grok Bot desktop app, which runs always-on AI agents	macOS

For each user on the device, Swif reports:

Install: whether the agent is installed, and its version
Background service: whether it's set up to run in the background
Running processes: whether it's running now
Risky launch flags: options it was started with that weaken its safeguards
Security settings: a summary of the agent's security settings

This policy only collects information. It doesn't install, change, or stop any agent.

What Swif checks for each agent

Hermes

Data	Details
Risky launch flags	`yolo`, which skips approval prompts, and `yolo_env`, `accept_hooks_env`, `ignore_user_config`, `safe_mode`, and `managed_dir_override`
Security settings	Approval mode, the number of deny and allow rules, disabled toolsets, the terminal backend, hooks, MCP servers, and whether the gateway allows all users

Watch for yolo. It lets Hermes run actions without asking the user first.

On Windows, Swif reports only whether Hermes is installed, its version, and its settings. Background service, running process, and launch flag data aren't available there.

Swif finds Hermes only in its default location, ~/.hermes. If a user moved it, Hermes shows as not installed.

Grok Bot

Data	Details
Risky launch flags	None
Security settings	Local tool permission (`ask`, `always`, or `never`), whether local egress is allowed, and whether the egress tunnel is enabled

Watch for always. It lets Grok Bot run commands on the device without asking.

These are the values Grok Bot last recorded on the device. Swif reports them, but doesn't enforce them.

Requirements

Requirement	Details
Operating systems	macOS, Linux, and Windows
Device ownership	Company-owned and BYOD
Agent	Swif Agentic Security agent installed and running. Deploy it with the Apple, Windows, or Linux Agentic Security Policy.

Agents that a platform doesn't support are skipped. For example, Grok Bot isn't collected on Linux or Windows.

Settings reference

Setting	What it does	Default	Range
Enabled	Turns agent inventory collection on or off.	Off	—
Agents	The agents to inventory: `hermes`, `grokbot`. Choose at least one when Enabled is on. Grok Bot is collected on macOS only.	Both	—
Collection Interval (Minutes)	How often, in minutes, the Swif agent collects the inventory.	60	30–1,440

A shorter interval keeps the inventory more current. A longer one uses fewer device resources. The 60-minute default suits most organizations.

When you create or change the policy, the device collects right away once it receives the policy, without waiting for the interval. Devices pick up policy changes within about 20 minutes.

Common uses

Find unapproved agents. See which devices and users have Hermes or Grok Bot installed, including installs IT didn't approve.
Find agents running in the background. Agents set up as a background service keep working after the user stops using them.
Spot risky settings. Find Hermes started with yolo, or Grok Bot with its local tool permission set to always.
Track versions. Find outdated installs that need updating.

Before you start

Deploy the Swif Agentic Security agent to the devices.
Tell users what's collected, especially on BYOD devices. The inventory includes each user's local username, along with the agents that user has installed and how they're set up.
Choose a pilot group of devices.

Create the policy

In Swif, go to Agentic Security > Policies.
Select Swif Agent Inventory Policy.
Under Agents, choose the agents to inventory.
Set Collection Interval (Minutes), or keep the 60-minute default.
Turn on Enabled.
Assign the policy to your devices and save.

Example configurations

Example 1: Fleet-wide discovery

Setting	Value
Enabled	On
Agents	`hermes`, `grokbot`
Collection Interval (Minutes)	1440 (once a day)

Assign to all devices to find where these agents are installed, with minimal device overhead.

Example 2: Closer watch on developer devices

Setting	Value
Enabled	On
Agents	`hermes`
Collection Interval (Minutes)	30

Check developer devices every 30 minutes for Hermes installs, background services, and risky launch flags such as yolo.

Verify the policy

Confirm that the device is online and the policy shows as applied.
Wait for the device to receive the policy, which takes up to about 20 minutes. The device collects right away once it has the policy.
In Swif, check the device's agent inventory.

Troubleshooting

An agent doesn't appear

Check that Enabled is on, and the agent is selected in Agents.
Check that the Swif Agentic Security agent is running.
Wait up to about 20 minutes for the device to receive the policy. It collects right away once it has it.
Grok Bot is collected on macOS only.

Hermes shows as not installed, but the user has it

Swif finds Hermes only in its default location, ~/.hermes. If the user installed or moved it somewhere else, Swif can't find it.

Hermes on Windows shows no running process or launch flags

This is expected. On Windows, Swif reports only whether Hermes is installed, its version, and its settings.

Grok Bot isn't reported on Windows

This is expected. The policy collects Grok Bot on macOS only.

An agent that isn't running shows as installed

The inventory reports installs separately from running processes. An installed agent may not be running at the time of collection.

Related resources

Swif

Agents