Discovery

Discovery lives at /dashboard/discovery. You connect sources, run a scan, review what was found and the risk of each item, then import and protect it. The Estate tabs for AWS scan, Discovery and Imported open this page.

• AWS quick pass: connect with a read-only role created from CloudShell, or with an access key. See AWS discovery IAM for the policy.
• GitHub: repositories, MCP configuration files and committed keys.
• OpenAI and Anthropic: organization keys, read through each provider's Admin API.
• Identity: AI app grants in Microsoft Entra, Google Workspace and Okta.
• Cloud AI services: Azure and Google Cloud AI resources.
• Traffic: AI app use seen in browser, DNS and proxy data.
• Intertrace itself: what you already govern, so findings show what is and is not protected.

A deep pass reads repository code: direct provider calls versus calls through the gateway, keys in any file, AI agents running in CI, and MCP server declarations. Disk scan results from SideScan are also accepted as a source.

Each item carries its risk reasons and a short path headline, and the execution graph shows how what was found connects. High-risk findings open Work findings for your team to triage. Discovery never opens incidents; a person decides that from the finding.

Every finding has a Protect plan. An item counts as protected only once the gateway actually sees its traffic, so coverage reflects real use, not configuration.

Scans run in the background, one task per source, and connected sources are rescanned daily. Download a PDF report of the latest results from the page (GET /api/discover/report).