Discover your agents

Connect a GitHub repository and Flint AI scans your code for AI agents. You end up with an inventory of every agent discovered in the repo — each with its highest severity and total issue count — along with the models, tools, and MCP servers it uses.

Flint AI on GitHub

Source code, example agents, and issue tracking

Before you start, you’ll need:

A GitHub repository containing Python agent code
A Flint AI API key
An API key for an LLM provider — Google Gemini, OpenAI, or Anthropic. The scanner uses it to analyze your agent code. Google Gemini has a free tier, so you can scan at no cost.

Supported frameworks: Google ADK, Google GenAI, Anthropic, OpenAI, OpenAI Agents SDK, LangGraph, CrewAI, AutoGen, HuggingFace Transformers, HuggingFace smolagents

Where to get an LLM provider key

Google Gemini: aistudio.google.com/apikey (free tier available)
OpenAI: platform.openai.com/api-keys
Anthropic: console.anthropic.com/settings/keys

Scan your repository

Get your Flint AI API key

In Flint AI, go to Settings, then API Keys, and create a key.

Copy your key immediately when created — it is shown only once. Keep it somewhere secure and never commit it to version control. In the next step you’ll add it as an encrypted GitHub Actions secret rather than pasting it into the workflow file.

Add the scan workflow to your repository

Create .github/workflows/flintai-inventory-scan.yml with:

name: Flint AI inventory scan
on:
  workflow_dispatch:
  schedule:
    - cron: "0 10 * * 1-5"
jobs:
  inventory-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@v5
      - name: Run Flint AI inventory scan
        uses: sandbox-quantum/flintai-codescan-action@v5
        with:
          flintai_instance: https://app.flintai.dev
          flintai_token: ${{ secrets.FLINTAI_TOKEN }}
          llm_model: google:gemini-3.5-flash
          llm_api_key: ${{ secrets.LLM_API_KEY }}

The workflow reads two secrets. In your repository, go to Settings, then Secrets and variables, then Actions, and add:

FLINTAI_TOKEN — the Flint AI API key from the previous step.
LLM_API_KEY — your LLM provider API key.

Choose a model

llm_model takes a provider:model value. The provider prefix tells the scanner which API key it is using:

anthropic:claude-opus-4-8       # Anthropic
openai:gpt-5.4                   # OpenAI
google:gemini-3.5-flash          # Google Gemini

Whichever provider you name, its key goes in the LLM_API_KEY secret.

What the scan does

The Action scans your repository for AI agents, finds security issues and misconfigurations, and sends results to your workspace. It needs only read access to your code and does not modify your repository. The schedule in the workflow keeps your inventory current as your code changes.

Instance URL doesn't need to be secret

Your instance URL is not sensitive, so flintai_instance is a plain value, not a secret. https://app.flintai.dev is the standard instance; other environments exist and use the same input.

Run the scan and see your agents

The workflow runs on the schedule in the file. To start it manually at any time: open the Actions tab in your repository, select Flint AI inventory scan, then Run workflow. The scan step takes a minute or two.To confirm results landed, go to Settings, then Data sources in Flint AI. Select GitHub and expand the Scans tab — it lists each connected repository with the time of its most recent scan. A fresh timestamp means your results arrived.

Check the Scans tab, not the Connected status. The status indicator does not yet reflect a live connection check, so it can read Connected before your first scan has run.

Now open the Agents page. Your discovered agents appear in the inventory, each with its highest severity and total issue count.

Multi-repo support: Connect more repositories to see all your agents in one workspace. Each agent traces back to its source repository and file path.

Next steps

Read your discovery results

Work out what needs attention first, whether a finding is real, and when it’s resolved

Monitor and protect

Install the SDK to monitor sessions and configure runtime protection

Overview

Get started

Discovery

Evaluation

SDK

Rules

Resources

Discover your agents

Flint AI on GitHub

Scan your repository

Next steps

Read your discovery results

Monitor and protect

Flint AI on GitHub

​Scan your repository

​Next steps

Read your discovery results

Monitor and protect

Scan your repository

Next steps