Scanning in SCMs
Scanning Source Code Repositories with UnifAI
UnifAI scans your source code repositories for policy violations, including AI-related risks, and opens a pull request that contains the fixes and a violations report. You run UnifAI through your SCM’s native CI/CD pipeline. The pipeline authenticates to Lineaje with a Lineaje Personal Access Token (PAT) and connects to a Lineaje Model Context Protocol (MCP) server, which performs the scan.
The scan engine is Source Code Manager (SCM)-agnostic. Supported SCMs include:
GitHub SaaS (GitHub.com) and GitHub Enterprise Cloud
GitHub Enterprise Server (self-hosted)
GitLab SaaS (GitLab.com) and GitLab self-hosted
Bitbucket Cloud and Bitbucket Data Center (on-premises)
How the Scan Works
When the pipeline runs, UnifAI performs the following steps:
Step
Action
Result
1
Clones repository
The MCP server clones your repository to the runner environment.
2
Evaluates for AI security policies and generates fixes
UnifAI generates remediation code for every violation found.
3
Creates remediation branch
A new branch is created in your repository to hold the fixes.
4
Opens pull request
A new PR (pull request) opens with the full violations report and all code changes.
As you merge remediation pull requests, the violation count decreases. You can track this reduction across scan iterations in the violations report.
Choosing a Deployment Path
Select the path that matches how your organization hosts its SCM and where the scan will run:
Path
When to Use
Where the scan runs
Your repositories are on a cloud-hosted SCM (e.g., GitHub.com or GitHub Enterprise Cloud).
Scan runs in Lineaje Cloud. The CI/CD pipeline connects to the Lineaje SaaS MCP endpoint by default.
You run a self-hosted SCM and want everything inside your network.
Scan runs within your environment. The Lineaje MCP server runs on a virtual machine (VM) in your network. Source code never leaves your environment.
Both paths produce the same output: a pull request on your repository containing remediation fixes for all detected violations, along with a violations report showing the policy name, file, line numbers that were changed, and what was remediated.
Last updated