Overview

Automatically inventory every AI dependency across your GitHub repositories — models, SDKs, MCP tools, gateway configs.

Discovery is Guardway’s AI-dependency inventory. Point it at your GitHub organization and it scans every repository to surface which LLM providers, AI services, SDKs, MCP tools, and gateway configs your codebase already touches — with a security score and a vulnerability list for each.

What it finds

Type	Examples
LLM Provider	Direct imports or API calls to OpenAI, Anthropic, Google, Mistral, etc.
AI Service	External AI services (moderation APIs, speech-to-text, image gen).
SDK Dependency	AI-related packages in package.json, requirements.txt, etc.
MCP Tool	Registered MCP servers and tools.
Gateway Config	Guardway or other AI-gateway configuration files.

How it works

1. Connect GitHub

   On Settings → Integrations, connect the GitHub App so Discovery can enumerate the repositories you grant access to.

2. Sync organizations

   Guardway pulls the list of orgs and repositories you can access.

3. Scan a repository

   Guardway analyzes the repo’s manifests and code, detects AI dependencies, and stores the result as a set of findings.

4. Review the findings

   Drill into any repo to see tabs for LLM Providers, AI Services, SDKs, MCPs, and Gateways; check the MCP security score; review SCA vulnerabilities.

5. Export an AIBOM

   Download a CycloneDX 1.6 AI Bill of Materials for any scanned repo.

Where to next

Organizations

Sync orgs, scan repos, filter by status.

Findings

Drill into a repository, see the findings tabs, security scans, and AIBOM export.

Scope

Discovery is platform-scoped (cloud). It runs on Guardway’s control plane using the GitHub token you provide — no agent, no gateway required. Audit entries for scan actions are recorded centrally on the Audit Log like every other administrative event.