Find agent files across repositories
Sweep every repository shared with Foo Guard for MCP configs, skills and agent instructions, including repositories not set up for scanning.
Page text and source link for your AI assistant. Nothing is sent automatically.
What it does
Repository scanning only covers repositories that have a .fooguard.yml file and have scanning turned on. The agent inventory sweep shows which other repositories hold agent files, so you can bring them under scanning.
Open Agents in your Team workspace and find Found in repositories. An owner or admin selects Run sweep. Every workspace member can see the results.
What the sweep reads
For each repository shared with the Foo Guard GitHub App, except archived ones, the sweep:
- Reads the file list on the default branch.
- Picks agent files by path:
| Kind | Paths |
|---|---|
| MCP config | .mcp.json, .cursor/mcp.json, .vscode/mcp.json, .gemini/settings.json, claude_desktop_config.json, Continue config.yaml and .continue/mcpServers/*, .codex/config.toml |
| Agent settings | .claude/settings.json, .claude/settings.local.json |
| Skill | SKILL.md |
| Agent instructions | AGENTS.md, CLAUDE.md, .cursorrules, .cursor/rules/*, .github/copilot-instructions.md, .windsurfrules |
- Opens up to 10 MCP config files per repository (256 KB each) and keeps only the MCP server names.
Foo Guard stores the file path, kind, client and server names. It never stores file contents, commands, environment values or credentials. A server name that looks like a credential is dropped.
The sweep uses the GitHub App's existing Contents: read permission. No new permission is needed.
Limits
- Files are found by path only. A file in the list doesn't prove an agent runs, and a repository with no files listed may still use agents.
- Up to 50 agent files are listed per repository. Repositories with more than 5,000 files are marked Too large to read.
node_modules,dist,build,coverage,.nextand.gitdirectories are skipped.- Codex TOML files are listed, but their servers aren't read.
- The sweep reads each repository once per run. Results don't update on push. Run a new sweep to refresh them.
Running and resuming
The sweep reads five repositories at a time while the page is open. Select Pause to stop it. If you leave the page or a request fails, select Continue sweep later. Repositories already read in this run are kept. Run a new sweep starts over and replaces the earlier results.
Starting and finishing a sweep are recorded in the workspace audit log, with repository and file counts only.
Bring a repository under scanning
For a repository marked Not scanned:
- Select Add .fooguard.yml in GitHub. GitHub opens its own editor with a minimal file (
version: 1). Commit it there. Foo Guard doesn't need write access for this. - Select Turn on scanning and enable the repository on the Repositories page.
The repository shows as Scanned after the next sweep. See .fooguard.yml to set scan paths and policy.