Airia Code Scanner
Discover the AI inside a codebase — SDK imports, model calls, and agents defined in code — from your CI pipeline.
A lot of AI never shows up in a cloud console. It lives in the code your developers write. The Airia Code Scanner inspects a codebase and discovers the AI in it: which AI SDKs are imported, which models are called, and which agents are defined in code. It runs inside your build or CI pipeline and reports its findings to Airia, where they become part of your governed inventory.
At a glance
| Surface | Code |
| What it does | AI Usage Signals — discovers the AI inside a codebase |
| How Airia connects | The scanner runs in your build/CI pipeline and reports findings to Airia |
| Who sets it up | Someone who can add a step to your build/CI pipeline |
| Time | ~15 min |
There is no login for Airia to store. You add the scanner step to your pipeline, give it your Airia API key as a secret, and the step reports findings to Airia each time it runs. You decide when scans happen.
Before you start
- Access to your CI / build pipeline, enough to add a build step (GitHub Actions, GitLab CI, Jenkins, and others all work).
- Your Airia API key (
ak-…), created under Settings → API Keys.
Works in any CI. The scanner is the same engine everywhere. If your code is on GitHub, the GitHub connector guide walks the GitHub-specific path.
The scanner is read-only to your code — it inspects your source to find AI usage, it does not change it. Findings refresh whenever a scan finishes, so you control the cadence through your pipeline.
Setup
The Airia Code Scanner tile carries its own full integration guide. Open Discover → Connect → Airia Code Scanner → Add connection and work through its sections (About → Generate API Key → Configure Secrets → Create Workflow → Verify Integration → Checklist). That guide includes the complete, copy-paste CI configuration. The steps below summarize it.
Part A — In your CI pipeline
Generate an Airia API key
- In Airia, go to Settings → API Keys → Generate Key.
- Name it descriptively, for example
code-scanner-prod. Keep the default scope. - Copy the generated key now — it starts with
ak-and is not shown again. Note your API URL too (https://api.airia.com, or your instance's URL).
Add the two secrets to your CI
Add these to your CI system's secrets store. Names are case-sensitive, with no trailing spaces.
| Secret name | Value |
|---|---|
AIRIA_API_URL | https://api.airia.com (or your instance URL) |
AIRIA_API_TOKEN | The ak-… key from the previous step |
Add the scanner step and run a scan
The scanner is a Docker image (airiadevops305/airia-code-scanner:latest) that runs in any CI
able to run containers. Your CI step pulls the image and runs it with the repository info and the
two secrets as environment variables: REPOSITORY, BRANCH, COMMIT_SHA, AIRIA_API_URL,
AIRIA_API_TOKEN.
The complete configuration for GitHub Actions is in the in-product integration guide. Adapt the same container invocation for GitLab CI, Jenkins, or your CI of choice.
Trigger a pipeline run (push a change, or run it manually) and watch it complete. Findings are sent to Airia when the run finishes.
Part B — In Airia
Open the Airia Code Scanner connection
- Go to Discover → Connect.
- Click the Airia Code Scanner tile → Connect.
View scan results
Once a scan has reported in, Airia shows its results and findings here.
Verify it worked
Discovered AI usage shows up under Discover → Inventory. Agents found in code land in the agent inventory.
Troubleshooting
| Symptom | Fix |
|---|---|
| The scanner step fails | Read the step's log in your CI system. Most failures are a missing or misnamed secret — confirm the secret name matches what the step expects. |
| No findings appear in Airia | Confirm the run finished successfully, and that the API key secret is valid and points at the right Airia endpoint. |
| "Unauthorized" / 401 in the log | The API key is wrong, expired, or the endpoint is wrong. Re-add a fresh ak-… key as the secret. |
| Findings are stale | Findings refresh on each scan. Trigger another pipeline run to re-scan. |
What you get
What Airia discovers
| Object | Discovered? | Source |
|---|---|---|
| AI SDK imports | Yes | Found in your source code by the scanner |
| Model calls | Yes | Calls to AI models found in code |
| Agents defined in code | Yes | Agent definitions found in code |
| Apps / data sources | — | Not produced by this connector |
Where it shows up
| In the product | What you see |
|---|---|
| Discover → Inventory | The AI usage found in your code, added to your unified inventory |
| Agent inventory | Agents defined in code, surfaced as governed assets |
| Asset detail | Per-finding metadata — what was found and where |
How often it syncs
Event-driven. Airia updates whenever a scan finishes, and you control when scans run through your pipeline — on every push, on a schedule, whatever your CI is set to. New AI usage appears after the next completed scan.
What you can do
Discover — see which AI SDKs, model calls, and agents live in your source code, so AI written directly into code isn't a blind spot.
Govern — every AI usage found in your code is inventoried, so you can classify it, assign owners, score risk, and track it in governance use cases.
This connector does not secure or change your codebase. It shows you where your applications use AI. To put runtime controls (DLP, guardrails, routing) around that usage, route the application's model traffic through the Airia AI Gateway — separate setup, covered in the AI Gateway documentation.
| Capability | Supported |
|---|---|
| Discover | Yes |
| Govern | Yes |
| Secure | — (discovery only; runtime controls come from the AI Gateway) |