> ## Documentation Index
> Fetch the complete documentation index at: https://evalgate.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Scan a repository for AI systems

> Build an exact-commit evidence graph and find missing evaluation coverage.

# Scan a repository for AI systems

Repository Intelligence reads a connected GitHub repository at one immutable
commit, detects source-backed AI components, and recommends evaluation packs
for uncovered risks. It never executes repository code.

## Start with one repository

You do not need to know what a trace, collector, or SDK is to start here.

1. Sign in to EvalGate and open **Setup** at `/setup`.
2. Under **Connect a GitHub repository**, choose **Choose repositories on
   GitHub**. A workspace admin may need to do this for you.
3. In GitHub, choose **Only select repositories**, pick the one codebase you
   want EvalGate to inspect, and approve the EvalGate App.
4. Return to EvalGate. Your selected repository appears on Setup; choose
   **Analyze repository** to begin.

EvalGate does not ask you for a personal access token. GitHub keeps control of
which repositories are shared, and EvalGate uses short-lived access while it
reads the selected repository. The CLI owns the same installation hop through
`evalgate login` and `evalgate link`. Link establishes durable
organization/repository/root context once; each scan and intake is separately
pinned to an exact target commit. Branch movement does not unlink the project,
and deterministic gates can run without a network request after linkage.

> [!NOTE]
>
> If you operate EvalGate, configure the GitHub App Setup URL as
> `https://your-evalgate-host.example/api/integrations/github/callback` and
> the signed webhook URL as
> `https://your-evalgate-host.example/api/webhooks/github-app`. The App ID,
> private key, slug, webhook secret, and authentication secret stay server-side.

## Scan from the web app

1. Connect the repository through **Setup** and the EvalGate GitHub App.
2. Open **Repository intelligence** at `/repository-intelligence`.
3. Select the connected repository and start a scan. You can pin a 40-character
   commit SHA or scan the current default-branch head.
   The workbench preserves and restores the exact queued, resolving, reading,
   detecting, graph-building, publishing, failed, or completed state if you
   leave or refresh the page.
4. Review detected providers, model routes, agents, prompts, tools and MCP,
   retrieval and memory, guardrails, evaluation frameworks, telemetry, domain
   signals, and release assets.
5. Inspect every finding's exact file and line evidence before installing a
   recommended pack.

> [!NOTE]
>
> A source detection is not runtime confirmation. The result records graph
> completeness and truncation reasons so a partial scan cannot be presented as
> complete evidence.

## Scan and ask from the CLI

Run `evalgate login` and `evalgate link` before this authenticated human CLI
workflow. CI or service automation uses a separately managed, least-privilege
`EVALGATE_API_KEY`:

```bash theme={null}
evalgate repo repositories
evalgate repo scan --repository 42 --head-sha <40-character-sha> \
  --idempotency-key scan-42-release
evalgate repo scans --repository 42
evalgate repo show --repository 42 --scan <scan-id>
evalgate repo ask --repository 42 \
  --question "What AI models, agents, tools, and evals exist?" \
  --graph-version <graph-version-id>
```

`repo scans` reports both durable attempts and authoritative completed scans.
An attempt can be queued, running at a named stage, or failed; only a completed
scan has a published graph. Once detection evidence is sealed, a worker retry
continues graph construction without reading the repository again.

The TypeScript package exposes the same workflow through
`client.repositoryIntelligence`. The Python package exposes it through
`client.repository_intelligence`.

Bot answers are bounded to one persisted graph version. Answers cite source
locators when evidence exists and return an explicit insufficient-evidence
state when it does not.

## Turn a finding into coverage

Open a recommended pack, review why its detector evidence caused the
recommendation, install it, and run the resulting active release gate. This
connects the repository commit to source evidence, evaluation coverage, and the
release decision.

Continue with [Install an evaluation pack](https://evalgate.com/docs/help/evaluation-packs/install-pack.md)
after reviewing the recommendation and its source evidence.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.