Connect your code. Discover what your AI could cause.
Authorize only the repositories you choose with the HAIEC GitHub App. Bind each source to the right AI System, identify consequential agent action paths, then run eligible deterministic Assurance from your dashboard, API or coding agent.
full remote coverage is the current recommended source-analysis mode. GitHub authorization remains scoped to your selected repositories.
From installation to a verified repository source.
GitHub App permission and HAIEC source verification serve different purposes. Walk through each step, including which account and system it belongs to, and what it enables next.
Find the HAIEC GitHub App.
Open the GitHub Marketplace search, locate the HAIEC App listing and review installation permissions. Use GitHub to select the account where you want to install it.
Find HAIEC on GitHub Marketplace →This is a Marketplace search, not a direct installer. Continue only through the verified App listing.
Confirm the correct personal or organization account and grant only the repositories needed.
What HAIEC can establish nextGitHub installation access begins the connection but does not create a verified Source Asset.
Review a changed file or inspect the full consequential path.
A PR check and an explicitly initiated whole-repository Assurance run answer different questions. Choose the workflow to see its trigger, source scope, output and appropriate link.
Catch relevant issues in the code being changed.
When enabled for an authorized repository, PR events can trigger analysis of changed files and may post GitHub-native findings or review comments.
A relevant pull-request event on a covered repository when enabled.
Changed-file or diff-specific context. Not every whole-repository analyzer necessarily runs.
A focused PR result or comment, not automatically a persisted HAIEC whole-repository Assurance Evaluation.
Your source can reveal the consequential action path early.
Authorized remote analysis can connect an AI agent, tool and handler to a downstream API. This supports a technical finding even when independent policy, delegated authority or runtime telemetry are still being evaluated.
An agent can reach a refund destination operation.
A supported source relationship reveals a potential financial mutation path through the tool and handler. This is a reason to review the implementation, not a claim that money moved.
Technical reachability is different from a completed transaction.
An inspectable route from agent-controlled code to a consequential operation.
Next assurance questionWhich policy, technical grants and business recipient-choice rules apply to the operation?
DAI examines delegated business decisions across applicable evidence, not as an additional evidence plane.
Run Assurance from your dashboard, AI coding agent or API.
Once the selected repository is connected to an AI System and verified, use an authorized HAIEC surface to initiate an eligible analysis and retrieve the exact persisted result.
Select your AI System and its verified repository.
Use the dashboard Assurance workflow for an eligible source. The source selection determines what repository is examined. Read the completed evaluation through its own report identity.
Authenticated HAIEC organization, selected AI System and verified Source Asset.
Available outputReal run status, bounded findings, and exact report artifacts when an Assurance Evaluation is issued.
1. Open HAIEC Assurance in your organization 2. Select the authorized AI System 3. Confirm the GitHub-backed Source Asset is VERIFIED 4. Request an eligible full remote Assurance run 5. Review persisted findings and evaluation artifacts
Repository access is deliberately scoped. Every permission has a purpose.
GitHub grants the App installation permissions. HAIEC resolves installation access server-side and binds the selected repository to a system in your HAIEC organization. This is not a request for your personal GitHub access token.
You choose the repositories
Keep installation permissions and selected repository access aligned to the minimum set needed.
Verified Source Asset
A source must match the authorized AI System, organization and active source status before an eligible remote run.
Short-lived server-side credentials
HAIEC mints the scoped GitHub App installation credential server-side. The API caller uses its own HAIEC-scoped key.
Choose remote depth or a local boundary that fits your environment.
Connected GitHub Remote
HAIEC's fuller current remote source-analysis stack reads authorized repository content through the GitHub App. Source binding is verified for the AI System.
Connected GitHub guide →Local IDE Analysis
The developer machine performs available bounded checks and can submit qualified Evidence Bundles, without sending repository archives for remote scanning.
IDE integration →Local CI Analysis
Scans run on the customer's CI runner with limited preview coverage. They are not identical to remote full analysis or an already released GitHub Action v2.
API and evidence guide →Get connected without granting more access than required.
Does installing the GitHub App automatically make the repository scannable?
No. GitHub installation authorizes selected repository access. The repository must also be connected to the appropriate HAIEC AI System as a verified, active Source Asset before a fresh full remote Assurance run can use it.
Where can I find the GitHub App installation link?
The current public guide links to the GitHub Marketplace search for HAIEC. Use the verified HAIEC App listing and its installation controls. The HAIEC /github/setup page is intended for the post-install continuation.
Why is my repository missing or not eligible?
Check which GitHub account or organization installed the App, which repositories were selected, whether access remains active, whether your HAIEC user is in the correct organization, and whether the Source Asset is connected and verified for the selected AI System.
Can HAIEC modify my repository source?
The documented installation permissions include repository contents read, repository metadata read and pull requests read/write. PR comments can be posted when enabled, but repository contents and branch modification are not authorized by those documented permissions.
What is the difference between a PR check and full remote Assurance?
PR checks inspect changed-file context and may post GitHub-native findings. Full remote Assurance must be explicitly initiated on a verified Source Asset and uses the canonical source/evaluation workflow. One is not proof of the other.
Do I need to give HAIEC a personal GitHub token?
No. The GitHub App installation is the source authorization path. HAIEC resolves short-lived installation credentials server-side. A separately scoped HAIEC API key is required for permitted API or MCP actions.
Can I run from Cursor or another MCP agent?
Yes, through a compatible client configured with the HAIEC Streamable HTTP MCP server and a scoped Bearer HAIEC API key. The agent can preflight the authorized system and eligible source, and invoke supported runs when requested.
Do missing policy and runtime sources prevent an initial code finding?
No. A supported code-reachability finding can reveal consequential capability within the scanned source. Additional policy, grants, DAI and actual target-side events answer more specific authority and execution questions.
What happens to my code in a remote scan?
The authorized repository is read by HAIEC remote scanner infrastructure via an installation-scoped credential minted server-side. For local/CI preview, available analysis runs on the customer machine or runner and submits supported qualified evidence instead.
Does HAIEC certify SOC 2 or issue compliance approval based on GitHub access?
No. Repository configuration and mapped findings may support a scoped assessment, but an installation, scan or example badge alone is not certification. Use the actual issued HAIEC evaluation and verification artifacts for precisely supported claims.
How do I check status or get help?
Use HAIEC’s GitHub integration status page, review the post-install setup flow and contact the published support address if source verification or authorized scanning fails.
Connect the right source. See the paths that matter.
Grant the repositories you choose, verify source ownership in HAIEC and use actual code-backed paths to answer consequential AI assurance questions.
Evidence backed by the exact source.
See how HAIEC connects code paths, delegated authority, technical access and observed behavior into reviewable findings and evaluation results when those facts are available.
Explore a Sample Assurance Report →