Agent Discovery

Use Agent Discovery to connect GitHub repositories to CorpAI, install a managed static scan workflow, and review AI-agent related activity found in source code.

Agent Discovery currently supports static scanning for repositories connected through GitHub.com or GitHub Enterprise Cloud. GitHub Enterprise Server is not covered by this setup path yet.

What It Does

Agent Discovery helps admins answer:

• Which GitHub accounts and organizations are connected to CorpAI?
• Which repositories are managed for static scanning?
• Which CorpAI-provided AI infrastructure signatures are present in code?
• Which repository-specific custom signatures has your team added?
• When did each repository last scan, and what did it observe?

The installed workflow scans repository files in GitHub Actions. It reports scan metadata, matched signature IDs, file paths, line numbers, match hashes, and redacted evidence snippets back to CorpAI.

Supported Setups

GitHub App Permissions

The GitHub App needs these repository permissions:

• Metadata: read-only
• Contents: read and write
• Workflows: read and write

Contents and Workflows write access are required because enabling a repository installs or updates the CorpAI-managed workflow file under .github/workflows/.

CorpAI-Hosted Setup

For CorpAI-hosted customers using GitHub.com or GitHub Enterprise Cloud:

1. In CorpAI, go to Platform -> Agent Discovery.
2. Click Connect GitHub App.
3. Install the CorpAI GitHub App on the GitHub account or organization you want CorpAI to manage.
4. Choose all repositories or selected repositories in GitHub.
5. Return to CorpAI and click Sync if the repository list does not update immediately.
6. In Repository Targeting, click Enable for each repository that should be scanned.

Enabling a repository installs the CorpAI workflow into that repository. Disabling a repository leaves repository inventory visible in CorpAI but removes the managed workflow file and stops future scans.

Repository Targeting

The repository table shows repositories available through connected GitHub App installations. From this table you can:

• Enable or disable static scanning for a repository.
• See whether the CorpAI workflow is installed and which workflow version is present.
• View the last run timestamp and open the GitHub Actions run.
• Manage repository-scoped custom signatures.

The workflow runs when commits land on the configured default branch, including merged pull requests, and when the workflow is manually dispatched in GitHub. When CorpAI updates the managed workflow file in an enabled repository, that update can also trigger a scan.

Signatures

Agent Discovery uses two signature sources:

• CorpAI bundle: CorpAI-managed AI infrastructure, model, framework, and credential patterns.
• Repository custom signatures: customer-defined signatures scoped to the repository where they were added.

Custom signatures can be entered manually or uploaded in bulk. Each custom signature can optionally specify match type and classification. If omitted, CorpAI uses safe defaults.

Activity And Scan History

Use Activity -> Agent Discovery to monitor scan results across repositories.

The activity view includes:

• Detected activity that needs review.
• Scan pipeline health across monitored repositories.
• Repository-level drilldowns for scan history, enabled CorpAI bundle signatures, and repository custom signatures.

Self-Hosted CorpAI

Self-hosted CorpAI can use Agent Discovery with GitHub.com or GitHub Enterprise Cloud when the GitHub Actions runner can reach your CorpAI backend.

At a high level:

1. Create a GitHub App in your GitHub organization or enterprise account using the CorpAI-provided manifest or settings.
2. Configure the app with your self-hosted CorpAI URLs.
3. Generate a GitHub App private key.
4. Configure your CorpAI backend with the app ID, app slug, private key, frontend URL, backend URL, and session secret.
5. Install the app from Platform -> Agent Discovery.

Recommended backend configuration:

GITHUB_APP_ID="<github-app-id>"
GITHUB_APP_SLUG="<github-app-slug>"
GITHUB_APP_PRIVATE_KEY="<pem-private-key>"
SESSION_SECRET_KEY="<long-random-secret>"
FRONTEND_APP_URL="https://<your-corpai-ui-domain>"
BACKEND_APP_URL="https://<your-corpai-api-domain>"

For GitHub.com and GitHub Enterprise Cloud, leave these values at their defaults unless CorpAI support tells you otherwise:

GITHUB_APP_BASE_URL="https://github.com"
GITHUB_API_BASE_URL="https://api.github.com"
GITHUB_ACTIONS_OIDC_AUDIENCE="corpai-agent-discovery"

Your GitHub App setup URL should point to:

https://<your-corpai-api-domain>/api/v1/agent-discovery/github/callback

Private Self-Hosted Endpoints

If your self-hosted CorpAI backend is not publicly reachable, GitHub-hosted runners will not be able to report scan results to CorpAI.

You can still support Agent Discovery if you provide one of these network paths:

• Run the workflow on self-hosted GitHub Actions runners that can reach BACKEND_APP_URL over your private network.
• Expose only the Agent Discovery callback and scan ingest endpoints through a customer-managed HTTPS ingress, reverse proxy, or tunnel.
• Use a temporary tunnel only for development or pilot testing, not as a production control.

For the current static scan workflow, the important runtime requirement is runner-to-CorpAI connectivity. Future webhook-driven features may require GitHub-to-CorpAI connectivity as well.

Required Runtime Endpoints

The installed workflow calls these backend routes:

POST /api/v1/agent-discovery/github/scans/start
POST /api/v1/agent-discovery/github/scans/{scan_session_id}/complete

GitHub App installation redirects use:

GET /api/v1/agent-discovery/github/callback

Limitations

• GHES is not supported by this setup path yet.
• The static scanner looks for configured signatures in source files; it is not a full runtime telemetry product.
• If the backend URL is private, runner networking must be planned before enabling repositories.

Next

Integrations →