Connect GitHub

GitHub discovery reads supported repository files through a GitHub App. It does not require every user to give ModelFence a personal access token.

Before connecting

• You need Admin or Owner in the selected ModelFence organization.
• The operator must configure a registered ModelFence GitHub App.
• Someone with installation authority must approve the App for the relevant GitHub account and repositories.

If GitHub appears unavailable, the operator must complete the App registration before you can connect it. Azure hosting and Entra sign-in alone do not enable repository discovery.

Connect and scan

1. Select your ModelFence organization and open Integrations.
2. Choose the GitHub connection action.
3. On GitHub, review the App and repository selection. Prefer selected repositories over account-wide access when that meets your needs.
4. Return to ModelFence and check the integration’s status.
5. Run or wait for discovery, then open the scan under Security tests.
6. Review statistics and gaps, then check Coverage, AI Inventory and Findings.

The App uses read access to repository contents and metadata. It does not commit fixes, change repository settings or automatically grant an agent extra permissions.

Supported sources

Discovery currently recognizes MCP configuration files, Claude Code project settings and AI agent usage in GitHub Actions. See supported configuration for filenames and examples. It does not perform general analysis of every framework implementation in your repository.

Keep the integration healthy

The integration card shows scopes, last synchronization and any error with a suggested remediation. Use Sync after changing a source. If repository access changes on GitHub, confirm the App installation still includes that repository before retrying.

Disconnect an integration when it should no longer supply data. Historical evidence can still explain past findings; disconnecting a source is not a remediation of the underlying repository configuration.

Common failures

Permission denied: check the App installation, repository selection and the account used to authorize it.

Connected but no assets: confirm that the repository contains supported files and review scan statistics. Empty supported-file counts are meaningful gaps, not a clean scan of all AI code.

Completed with gaps: follow the scan’s per-source remediation and rerun discovery. Partial scans do not automatically clear findings from repositories that were not fully evaluated.