Discover shows the AI your organization uses through the AI Gateway that no AI system accounts for: requests on keys that belong to no AI system. Each key’s traffic is one row, with what it cost and which clients and models it used, and one action brings it under governance.
Discover, under Govern in the sidebar, is for owners and admins when your organization has the AI Gateway. Nothing is installed anywhere: Discover reads the AI Gateway’s own request log.
What counts as unregistered
A request sent with no key is left out. Choose the range at the top: This month by default, up to 92 days.
Coverage
Four figures sum up the range. Point at a label, tap it or open it from the keyboard to see how it is worked out.
Assets not reviewed
Under the figures, Assets not reviewed lists what is in use and nobody has decided about yet:
- each MCP server that is Not reviewed, with how many tools it has, how many are destructive, and whether it has an owner;
- each model used in the range that is Not reviewed in the Model catalog, with its provider and requests.
Review opens the server in AI assets, MCP servers, or the Model catalog. Once someone decides, it leaves the list. With nothing waiting, the section is not there.
What each row shows
Each row is one key, the busiest first: its name and when it was first seen (or the person, for a personal key), the Clients it was used through (Claude Code, Cursor, SDKs and others; Other is a client the AI Gateway did not recognise, and None named means the requests named no client), Requests, Spend, the Models asked for, how many MCP tools it called, and when it was Last seen. A key that was revoked shows Revoked. Discover lists the 200 busiest keys.
View requests in a row’s menu opens the request log filtered to that key over the same range.
Register as AI system
Register as AI system on an organization key opens the usual registration with a fourth step:
Details
Filled in from the key’s traffic: the client it was used through as the name (or the key’s name), and a description naming the clients and models, and when it was first seen. Change anything, and add the purpose.
Risk profile
The same seven questions as registering by hand.
Keys
Your organization’s active keys that belong to no AI system. The key you started from is ticked, and so is every other key that sent traffic through the same client. Untick any. Personal keys are not listed: they stay their owner’s.
Review
The suggested rating, and how many keys will be attached. Choose Register and attach.
Attaching is final: a key cannot be moved to another AI system or detached. Its requests count as the AI system’s from then on.
Attach to an AI system
When a key’s traffic belongs to an AI system you already registered, choose Attach to an AI system in its menu and pick the AI system. Attaching is final, as it is under Virtual keys. A personal key cannot be attached.
Dismiss traffic that needs no AI system
Some traffic is known and fine: a developer trying a model on their own key, a load test. Choose Dismiss in its menu and say why, in up to 500 characters. The key moves to Dismissed, which lists each with its reason, who dismissed it and when, and the number of requests at which it comes back.
A dismissed key comes back to To review on its own once it has sent five times the requests it had sent when it was dismissed. Restore brings it back by hand. A dismissed key does not raise the Unregistered AI alert.
Telling you about it
The Unregistered AI alert fires when a key with no AI system sends more than 50 requests in a day (you can set 10 to 100,000), once for each key, and never for a dismissed key. It opens Discover.
The bill of materials
Each AI system’s Overview shows a Bill of materials card for the last 30 days: the models it used with requests and spend, marked Under review or Blocked when the Model catalog says so, the MCP tools it called by server with the number of calls, and the prompts it used with their version. The card is not there when the AI system sent no requests.
Recorded in the audit trail
Dismissing traffic and bringing it back each add an entry to the audit trail. Registering an AI system and attaching a key are recorded as they always are. 
