Discover your agents

Discovery finds the AI agents you already have — in your code and in your cloud. Connect a data source and Switch Trust scans it, then builds an inventory of every agent it finds, each with its highest severity and total issue count, along with the models, tools, and MCP servers behind it. Switch Trust scans the following kinds of data source:

Code repositories — GitHub and GitLab. Switch Trust scans your source code for agents.
Cloud accounts — AWS and GCP. Switch Trust scans your account for deployed AI resources.

Switch Trust CLI on GitHub

Source code, example agents, and issue tracking

Before you start, you’ll need:

For a code repository (GitHub or GitLab): a repository with Python agent code, a Switch Trust API key, and an API key for an LLM provider — Google Gemini, OpenAI, or Anthropic. The scanner uses it to analyze your code, and Google Gemini has a free tier, so you can scan at no cost.
For a cloud account (AWS or GCP): write permissions in the account or project, so that the required roles and resources can be created. No LLM key is needed.

Supported frameworks (code scans): Google ADK, Google GenAI, Anthropic, OpenAI, OpenAI Agents SDK, LangGraph, CrewAI, AutoGen, HuggingFace Transformers, HuggingFace smolagents

Where to get an LLM provider key

Google Gemini: aistudio.google.com/apikey (free tier available)
OpenAI: platform.openai.com/api-keys
Anthropic: console.anthropic.com/settings/keys

Scan a code repository

Switch Trust scans the source code in your repository for AI agents and reports the models, tools, and MCP servers behind them, along with any issues it finds. The scan runs inside your own CI, so there is no credential to store in Switch Trust — you authenticate it with your Switch Trust API key.

GitHub

The GitHub scan runs as a GitHub Action in your workflow.

Get your Switch Trust API key

In Switch Trust, go to Settings, then API Keys, and create a key and give it the Editor role, the least-privilege role that can upload scan results. A Viewer key can download the scanner but can’t upload results, so the scan fails with a permission error.

Copy your key immediately when created — it is shown only once. Keep it somewhere secure and never commit it to version control. In the next step you’ll add it as an encrypted GitHub Actions secret rather than pasting it into the workflow file.

Add the scan workflow to your repository

Create .github/workflows/switch-trust-inventory-scan.yml with:

name: Flint AI inventory scan
on:
  workflow_dispatch:
  schedule:
    - cron: "0 10 * * 1-5"
jobs:
  inventory-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@v5
      - name: Run Flint AI inventory scan
        uses: sandbox-quantum/switch-trust-codescan-action@v7
        with:
          switch_trust_instance: https://app.switchagents.ai
          switch_trust_token: ${{ secrets.SWITCH_TRUST_TOKEN }}
          llm_model: google:gemini-3.5-flash
          llm_api_key: ${{ secrets.LLM_API_KEY }}

The workflow reads two secrets. In your repository, go to Settings, then Secrets and variables, then Actions, and add:

SWITCH_TRUST_TOKEN — the Switch Trust API key from the previous step.
LLM_API_KEY — your LLM provider API key.

Choose a model

llm_model takes a provider:model value. The provider prefix tells the scanner which API key it is using:

anthropic:claude-opus-4-8       # Anthropic
openai:gpt-5.4                   # OpenAI
google:gemini-3.5-flash          # Google Gemini

Whichever provider you name, its key goes in the LLM_API_KEY secret.

What the scan does

The Action scans your repository for AI agents, finds security issues and misconfigurations, and sends results to your workspace. It needs only read access to your code and does not modify your repository. The schedule in the workflow keeps your inventory current as your code changes.

Instance URL doesn't need to be secret

Your instance URL is not sensitive, so switch_trust_instance is a plain value, not a secret. https://app.switchagents.ai is the standard instance; other environments exist and use the same input.

Run the scan and see your agents

The workflow runs on the schedule in the file. To start it manually at any time: open the Actions tab in your repository, select Flint AI inventory scan, then Run workflow. The scan step takes a minute or two.To confirm results landed, go to Settings, then Data sources in Switch Trust. Select GitHub and expand the Scans tab — it lists each connected repository with the time of its most recent scan. A fresh timestamp means your results arrived.

Check the Scans tab, not the Connected status. The status indicator does not yet reflect a live connection check, so it can read Connected before your first scan has run.

Now open the Agents page. Your discovered agents appear in the inventory, each with its highest severity and total issue count.

Multi-repo support: Connect more repositories to see all your agents in one workspace. Each agent traces back to its source repository and file path.

For the full reference, including the Setup tab and Scans tab, see the GitHub reference.

GitLab

The GitLab scan runs as a CI/CD component in your pipeline. GitLab is a separate data source from GitHub, so agents found on each are tracked and shown apart.

Add the CI/CD component to your pipeline

Include switch-trust-codescan-workflow from the GitLab CI/CD Catalog in the .gitlab-ci.yml for your project:

include:
  - component: $CI_SERVER_FQDN/sandboxaq/switch-trust-codescan-workflow/inventory-scan@2.0.1
    inputs:
      switch_trust_instance: https://app.switchagents.ai
      switch_trust_token: $SWITCH_TRUST_TOKEN
      llm_model: anthropic:claude-opus-4-8
      llm_api_key: $ANTHROPIC_API_KEY

A GitLab component cannot read your CI/CD variables on its own, so pass $VARIABLE references explicitly.

Add your secrets as masked CI/CD variables

In your project or group, go to Settings, then CI/CD, then Variables, and add masked variables:

SWITCH_TRUST_TOKEN — your Switch Trust API key, from Settings, then API Keys in Switch Trust. Give the key the Editor role.
Your LLM provider key — named for the provider (ANTHROPIC_API_KEY, OPENAI_API_KEY, or GOOGLE_API_KEY) to match your llm_model.

Define them at the group level to share across projects.

Run the pipeline and confirm results

Run the pipeline. To confirm results landed, go to Settings, then Data sources in Switch Trust, select GitLab, and expand the Scans tab — a fresh timestamp means your results arrived.

For the full setup, including restricting the scan to your default branch or targeting a specific runner, see the GitLab reference.

Scan a cloud account

Switch Trust reads your cloud account and discovers the AI resources deployed in it. It connects read-only through short-lived or assumed credentials, so there are no long-lived keys to store. Connecting a cloud account requires write permissions in it, so that the required roles and resources can be created.

AWS

Switch Trust assumes a read-only IAM role in your account and scans it across active regions, discovering Amazon Bedrock models and agents, Amazon Lex bots, and Amazon SageMaker models.

Deploy the read-only role

In Switch Trust, go to Settings, then Data sources, select AWS, and open the Setup tab. Download the CloudFormation template and deploy it in your AWS account to create the read-only role SwitchTrustReadOnlyAccessRole. IAM roles are global, so one stack covers every region.

Give Switch Trust the role ARN

In the AWS IAM console, open the SwitchTrustReadOnlyAccessRole role and copy its Amazon Resource Name (ARN). Back on the Setup tab, paste it into IAM role ARN and select Connect.

Scan the account

Select Test connection to confirm Switch Trust can assume the role, then Start scan. Watch progress on the Scans tab.

For the full CloudFormation walkthrough, see the AWS reference.

GCP

Switch Trust reads your project through Workload Identity Federation, which issues short-lived credentials, and scans each Vertex AI location, discovering your Vertex AI models and agents.

Set up Workload Identity Federation

In Switch Trust, go to Settings, then Data sources, select GCP, and open the Setup tab. Download the Terraform template and apply it in Google Cloud Shell to create a Workload Identity pool and provider and a read-only service account.

Enter the Terraform outputs

Copy the values from the Terraform output into the matching Setup fields: Project ID and Project number, Service account email, and WIF pool ID and WIF provider ID.

Test and add the project

Select Test connection to confirm the federation works, then Add project. Watch progress on the Scans tab.

For the full Terraform walkthrough, see the GCP reference.

Next steps

Read your discovery results

Work out what needs attention first, whether a finding is real, and when it’s resolved

Connect more data sources

Manage your GitHub, GitLab, AWS, and GCP connections in one place

Monitor and protect

Install the SDK to monitor sessions and configure runtime protection

Overview

Get started

Agents and assets

Discovery

Evaluation

Monitor your agents

Set guardrails

Track cost and value

Optimize with the MCP server

Manage your organization

SDK

Rules

Resources

Discover your agents

Switch Trust CLI on GitHub

Scan a code repository

GitHub

GitLab

Scan a cloud account

AWS

GCP

Next steps

Read your discovery results

Connect more data sources

Monitor and protect

Switch Trust CLI on GitHub

​Scan a code repository

​GitHub

​GitLab

​Scan a cloud account

​AWS

​GCP

​Next steps

Read your discovery results

Connect more data sources

Monitor and protect

Scan a code repository

GitHub

GitLab

Scan a cloud account

AWS

GCP

Next steps