> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flintai.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Discover your agents

> Find AI agents in your code in less than 10 minutes

Connect your GitHub repository to automatically discover agents in your code. Within minutes, see which agents exist, what they use (models, tools, MCP servers), and what issues need attention.

<Note>
  **Requirements:** GitHub repository containing Python agent code

  **Supported frameworks:** Google ADK, Google GenAI, Anthropic, OpenAI, OpenAI Agents SDK, LangGraph, CrewAI, AutoGen, HuggingFace Transformers, HuggingFace smolagents
</Note>

## Set up GitHub Action

Log into [Flint AI](https://app.flintai.dev) and configure the GitHub Action to scan your repository.

<Accordion title="What does the GitHub Action do?">
  The GitHub Action scans your repository for AI agents, finds security issues and misconfigurations, and sends results to your workspace. It runs on a schedule you configure (for example, daily) and keeps your inventory current as code changes.

  The Action requires only read access to your code and does not modify your repository.
</Accordion>

<Steps>
  <Step title="Get your credentials">
    Navigate to **Settings > Data sources** and select **GitHub**, then open the **Setup** tab. You'll need two values:

    * **FLINTAI\_INSTANCE** - Your instance URL (shown in the Setup tab)
      ```
      https://your-instance.flintai.dev
      ```

    * **FLINTAI\_TOKEN** - Use an existing Flint AI API token, or create one now if you don't yet have one. Tokens are managed in **Settings → API Keys**.

    <Note>
      Copy your token immediately when created — it will only be shown once.
    </Note>
  </Step>

  <Step title="Install the GitHub Action">
    Install `sandbox-quantum/aispm-inventory-action` from the [GitHub Marketplace](https://github.com/marketplace/actions/sandboxaq-aqtive-guard-ai-spm-inventory-scan) and add it to your repository's workflow.
  </Step>

  <Step title="Store your token as a GitHub secret">
    In your repository (or organization) settings, go to **Secrets and variables → Actions**.

    Add a secret named `FLINTAI_TOKEN` with the token you generated in Step 1.

    <Tip>
      Scanning multiple repositories? Define this secret at the Organization level so all repos share it.
    </Tip>

    <Accordion title="Instance URL doesn't need to be secret">
      Only the token needs to be a secret. Your instance URL isn't sensitive — pass it to the action's `flintai_instance` input as a plain value.

      The GitHub Action reads `FLINTAI_TOKEN` automatically once the secret is set — it maps to the action's `flintai_token` input. No extra configuration is needed.
    </Accordion>
  </Step>

  <Step title="Configure the scan">
    The GitHub Action uses AI to analyze your agent code and identify vulnerabilities. In your workflow file, set `LLM_MODEL` as an environment variable for the action using `provider:model` format:

    ```
    openai:gpt-5.4                    # OpenAI
    google:gemini-3.1-flash-lite      # Google Gemini
    anthropic:claude-opus-4-8         # Anthropic
    ```
  </Step>

  <Step title="Add your LLM provider's API key">
    In your repository settings, go to **Secrets and variables → Actions** and add your provider's API key using the standard framework name:

    ```
    OPENAI_API_KEY        # OpenAI
    GOOGLE_API_KEY        # Google Gemini
    ANTHROPIC_API_KEY     # Anthropic
    ```

    The action automatically detects which key is present and passes it to the scanner.

    <Accordion title="Where to get LLM provider API keys">
      * **Google Gemini**: [aistudio.google.com/apikey](https://aistudio.google.com/apikey) (free tier available)
      * **OpenAI**: [platform.openai.com/api-keys](https://platform.openai.com/api-keys)
      * **Anthropic**: [console.anthropic.com/settings/keys](https://console.anthropic.com/settings/keys)
    </Accordion>

    <Tip>
      **Start free.** Google Gemini offers a free tier with generous limits — test scanning with no API costs.
    </Tip>
  </Step>
</Steps>

## View discovered agents

Navigate to the **Agents** page. Within a few minutes, discovered agents appear in your inventory.

For each agent, you can quickly see:

* **Name** - The agent identifier
* **Highest severity** - The most serious issue found, from critical to low severity
* **Issues** - The total number of findings

Select an agent to inspect its components — including models, tools, and MCP servers — and review detailed findings with recommended remediation steps.

<Tip>
  **Multi-repo support:** Connect multiple repositories to see all your agents in one workspace. Each agent traces back to its source repository and file path.
</Tip>

## Next steps

<CardGroup cols={2}>
  <Card title="Review findings" icon="triangle-exclamation" href="/flintai/platform/discovery/results">
    Understand issues, severity levels, and how to resolve them
  </Card>

  <Card title="Monitor and protect" icon="shield-halved" href="/flintai/platform/getting-started/runtime">
    Install the SDK to monitor sessions and configure runtime protection
  </Card>
</CardGroup>