Agent Capabilities
A capability is an agent's statement that it can honor a specific kind of command. Tools that reach onto a host — WMI queries, journal reads, ETW traces — each require the target agent to advertise the matching capability, and an agent that does not advertise it rejects the call. This page is the reference for what each capability means, when a host advertises it, and which tools depend on it.
Probes, Not Platforms
Capabilities are detected on the host, not assumed from its operating system. Being Windows does not earn a host the wmi chip — the agent probes whether the WMI subsystem actually answers queries, and only advertises the capability when it does. The same holds across the set: journald appears only when the system journal is genuinely readable by the agent, perfmetrics only when the kernel's performance counters can be read, etw only when the agent can create its trace directory.
This is why a capability chip in the Agents view means more than "right OS". A chip appearing means the host can honor that capability right now. A chip missing on a host that "should" have it is a diagnostic signal, not a display quirk — something on that host is preventing the capability, and the What a Missing Capability Means section below tells you where to look.
Probes run when the agent connects, so a fixed host corrects itself: restart the agent after repairing WMI and the capability reappears without re-enrollment.
The Capability Reference
| Capability | Platforms | Advertised when | Required by |
|---|---|---|---|
shell | All | Always | agent_exec_shell |
log_file | All | Always | agent_read_log_file |
powershell | Windows | Always on Windows | agent_exec_powershell, agent_exec_powershell_readonly |
eventlog | Windows | Always on Windows | agent_list_event_logs, agent_query_event_log |
wmi | Windows | The WMI subsystem answered the agent's startup probe | agent_exec_wmi |
perfcounter | Windows | A performance counter query opens cleanly | agent_perf_list_counters, agent_perf_read_counters |
etw | Windows | The agent can create its trace directory | agent_trace_start, agent_trace_read, agent_trace_stop, agent_trace_list, collection_start |
etw_autologger | Windows | The agent may configure boot-time capture | collection_arm_boot, collection_disarm_boot, collection_harvest_boot |
ldap | All | LDAP is configured on the agent | agent_exec_ldap |
daemon_start | Linux | The host is systemd-managed | agent_exec_daemon_start |
journald | Linux | The system journal is readable by the agent | agent_query_journald |
perfmetrics | Linux | Kernel performance data is readable | agent_perf_read_metrics |
mcp_proxy | Linux | An operator enabled MCP hosting on the host | Hosting MCP servers; not called directly by a tool |
The first four rows are unconditional for their platform — every healthy agent carries them. Everything below is conditional on the host's actual state, which is what makes the chips worth reading.
What a Missing Capability Means
When a tool refuses a host with a capability error, or a chip you expect is absent, the capability's condition tells you what to check.
wmi missing on Windows usually means the WMI service is stopped or its default namespace refused the agent's connection. Repair WMI on the host, restart the agent service, and the capability returns.
perfcounter or etw missing on Windows points at a constrained service account. Both probes need rights a locked-down account may lack — performance counter access for one, the ability to create the agent's trace directory for the other. Agents running as LocalSystem always qualify.
etw_autologger missing means the agent may not configure boot-time capture on that host — the boot collection tools need more than an ordinary trace session does, so a host can legitimately carry etw without it.
journald missing on Linux almost always means permissions: the agent can only read the system journal when it runs as root or belongs to the journal-reader group. Without that, journal queries would silently see an empty journal — so the agent declines to advertise the capability rather than answer wrongly.
daemon_start missing simply means the host is not systemd-managed. macOS, Windows, and non-systemd Linux never advertise it; there is nothing to fix.
ldap missing means LDAP is not configured on that agent. It is configuration, not a probe — add the LDAP settings on the host (or at enroll time) and restart the agent. The deploy pages for Windows, Linux, and macOS cover the settings.
mcp_proxy missing means no operator has enabled MCP hosting on that host. Enabling it is deliberately a local decision made on the machine itself, not something an administrator can switch on from the portal.
Finding Hosts by Capability
Both discovery tools take a capability filter, matched exactly against what each host advertises. Asking is one call:
"How many hosts can run WMI queries?"
behind which the AI runs agent_count(capability="wmi") and reads the exact, uncapped total. The same filter on agent_list returns the hosts themselves, and it composes with the status, OS, search, and group filters. See Agent Tools for the full arguments.
In the portal, each agent's chips show its advertised set in the Agents view, and the Admin Agents view supports querying by capability across the fleet.