Repository scanning

How Team GitHub repository scans work end to end.

Repository scans use the same deterministic Foo Guard engine as dashboard and API analysis.

Foo Guard:

  • reads .fooguard.yml (or legacy .agentguard.yml)
  • discovers supported agent configuration files
  • analyzes sanitized configuration in memory
  • persists safe scan summaries and structural finding locations
  • publishes GitHub Check runs when configured

Foo Guard does not clone or source-scan arbitrary repository code outside configured scan paths.

Related pages