How to run a script inventory
You do not need us for the first one. You need an afternoon, a browser, and the willingness to ask people what things are.
We would rather you did this and concluded you have no problem than bought monitoring for a problem you never measured. Here is the manual version.
1. Capture what actually loads
Open your checkout in a clean browser profile with no extensions, open the network panel, and complete a full flow with a test order. Record every request for a script, including ones that arrive after the page has settled — several of the interesting ones load late, and some only load on the payment step.
Do it twice on different days. Tag managers do not always deliver the same set.
2. Group by who owns them
Three buckets: code you wrote, code a vendor supplies directly, and code delivered through a tag manager. The third bucket is the one that grows without anybody deciding, because its editors are usually not engineers.
3. Ask what each one is for
Go person by person, not system by system. The question is "why is this on the checkout page", and an acceptable answer names a business reason and a person. "It was already there" is not an answer; it is the finding.
Expect roughly a third of the list to have no current owner. That is normal and it is the point of the exercise.
4. Check what they are allowed to do
Look at your content security policy while you are here. Most CSPs on live storefronts are far more permissive than the people maintaining them believe, because every entry was added by a competent person to fix a real breakage under time pressure. More on that.
5. Remove, then write it down
Remove what has no owner, in a normal release, with a rollback ready. Then write the list down with the reason beside each entry and the date, and put it where the next person will find it.
That document is the baseline. Whether you maintain it by hand from here or with a tool is a separate decision, and a much easier one to make once you have seen the list.
When to do it again
Before peak season, after any tag manager permission change, and whenever a vendor relationship ends. The last one is the most commonly skipped and the most commonly regretted.