Skip to main content

​
Scan a repository for AI systems

Repository Intelligence reads a connected GitHub repository at one immutable commit, detects source-backed AI components, and recommends evaluation packs for uncovered risks. It never executes repository code.

​
Start with one repository

You do not need to know what a trace, collector, or SDK is to start here.
  1. Sign in to EvalGate and open Setup at /setup.
  2. Under Connect a GitHub repository, choose Choose repositories on GitHub. A workspace admin may need to do this for you.
  3. In GitHub, choose Only select repositories, pick the one codebase you want EvalGate to inspect, and approve the EvalGate App.
  4. Return to EvalGate. Your selected repository appears on Setup; choose Analyze repository to begin.
EvalGate does not ask you for a personal access token. GitHub keeps control of which repositories are shared, and EvalGate uses short-lived access while it reads the selected repository. The CLI owns the same installation hop through evalgate login and evalgate link. Link establishes durable organization/repository/root context once; each scan and intake is separately pinned to an exact target commit. Branch movement does not unlink the project, and deterministic gates can run without a network request after linkage.
If you operate EvalGate, configure the GitHub App Setup URL as https://your-evalgate-host.example/api/integrations/github/callback and the signed webhook URL as https://your-evalgate-host.example/api/webhooks/github-app. The App ID, private key, slug, webhook secret, and authentication secret stay server-side.

​
Scan from the web app

  1. Connect the repository through Setup and the EvalGate GitHub App.
  2. Open Repository intelligence at /repository-intelligence.
  3. Select the connected repository and start a scan. You can pin a 40-character commit SHA or scan the current default-branch head.
  4. Review detected providers, model routes, agents, prompts, tools and MCP, retrieval and memory, guardrails, evaluation frameworks, telemetry, domain signals, and release assets.
  5. Inspect every finding’s exact file and line evidence before installing a recommended pack.
A source detection is not runtime confirmation. The result records graph completeness and truncation reasons so a partial scan cannot be presented as complete evidence.

​
Scan and ask from the CLI

Run evalgate login and evalgate link before this authenticated human CLI workflow. CI or service automation uses a separately managed, least-privilege EVALGATE_API_KEY:
The TypeScript package exposes the same workflow through client.repositoryIntelligence. The Python package exposes it through client.repository_intelligence. Bot answers are bounded to one persisted graph version. Answers cite source locators when evidence exists and return an explicit insufficient-evidence state when it does not.

​
Turn a finding into coverage

Open a recommended pack, review why its detector evidence caused the recommendation, install it, and run the resulting active release gate. This connects the repository commit to source evidence, evaluation coverage, and the release decision. Continue with Install an evaluation pack after reviewing the recommendation and its source evidence.