Skip to main content
Connect your GitHub repository to automatically discover agents in your code. Within minutes, see which agents exist, what they use (models, tools, MCP servers), and what issues need attention.
Requirements: GitHub repository containing Python agent codeSupported frameworks: Google ADK, Google GenAI, Anthropic, OpenAI, OpenAI Agents SDK, LangGraph, CrewAI, AutoGen, HuggingFace Transformers, HuggingFace smolagents

​
Set up GitHub Action

Log into Flint AI and configure the GitHub Action to scan your repository.
The GitHub Action scans your repository for AI agents, finds security issues and misconfigurations, and sends results to your workspace. It runs on a schedule you configure (for example, daily) and keeps your inventory current as code changes.The Action requires only read access to your code and does not modify your repository.
1

Get your credentials

Navigate to Settings > Data sources and select GitHub, then open the Setup tab. You’ll need two values:
  • FLINTAI_INSTANCE - Your instance URL (shown in the Setup tab)
  • FLINTAI_TOKEN - Use an existing Flint AI API token, or create one now if you don’t yet have one. Tokens are managed in Settings → API Keys.
Copy your token immediately when created — it will only be shown once.
2

Install the GitHub Action

Install sandbox-quantum/aispm-inventory-action from the GitHub Marketplace and add it to your repository’s workflow.
3

Store your token as a GitHub secret

In your repository (or organization) settings, go to Secrets and variables → Actions.Add a secret named FLINTAI_TOKEN with the token you generated in Step 1.
Scanning multiple repositories? Define this secret at the Organization level so all repos share it.
Only the token needs to be a secret. Your instance URL isn’t sensitive — pass it to the action’s flintai_instance input as a plain value.The GitHub Action reads FLINTAI_TOKEN automatically once the secret is set — it maps to the action’s flintai_token input. No extra configuration is needed.
4

Configure the scan

The GitHub Action uses AI to analyze your agent code and identify vulnerabilities. In your workflow file, set LLM_MODEL as an environment variable for the action using provider:model format:
5

Add your LLM provider's API key

In your repository settings, go to Secrets and variables → Actions and add your provider’s API key using the standard framework name:
The action automatically detects which key is present and passes it to the scanner.
Start free. Google Gemini offers a free tier with generous limits — test scanning with no API costs.

​
View discovered agents

Navigate to the Agents page. Within a few minutes, discovered agents appear in your inventory. For each agent, you can quickly see:
  • Name - The agent identifier
  • Highest severity - The most serious issue found, from critical to low severity
  • Issues - The total number of findings
Select an agent to inspect its components — including models, tools, and MCP servers — and review detailed findings with recommended remediation steps.
Multi-repo support: Connect multiple repositories to see all your agents in one workspace. Each agent traces back to its source repository and file path.

​
Next steps

Review findings

Understand issues, severity levels, and how to resolve them

Monitor and protect

Install the SDK to monitor sessions and configure runtime protection