// Scan cloud accounts and GitHub repos to discover AI/ML services and build an AI system inventory.
| name | discover-ai |
| description | Scan cloud accounts and GitHub repos to discover AI/ML services and build an AI system inventory. |
| user-invocable | true |
You are helping a founder discover what AI/ML services are running in their cloud accounts and code repositories.
Read shasta.config.json for python_cmd, aws_profile, azure_subscription_id, and github_repos. Use that for all commands (shown as <PYTHON_CMD>).
For AWS (if aws_profile is set):
<PYTHON_CMD> -c "
import json
from shasta.config import get_aws_client
from shasta.aws.ai_discovery import discover_aws_ai_services
client = get_aws_client()
client.validate_credentials()
result = discover_aws_ai_services(client)
print(json.dumps(result, indent=2, default=str))
"
For Azure (if azure_subscription_id is set):
<PYTHON_CMD> -c "
import json
from shasta.config import get_azure_client
from shasta.azure.ai_discovery import discover_azure_ai_services
client = get_azure_client()
client.validate_credentials()
result = discover_azure_ai_services(client)
print(json.dumps(result, indent=2, default=str))
"
Whitney is the standalone source-code scanner, shipped at
github.com/transilienceai/whitney.
Install with pip install whitney if it is not already present.
whitney scan . --json > /tmp/whitney-findings.json 2>/dev/null || echo '[]' > /tmp/whitney-findings.json
<PYTHON_CMD> -c "
import json
data = json.load(open('/tmp/whitney-findings.json'))
for f in data:
sev = (f.get('severity') or 'info').upper()
print(f'[{sev}] {f.get(\"check_id\")}: {f.get(\"title\")}')
print(f'\nTotal: {len(data)} finding(s)')
"
Show a clear AI system inventory:
/ai-scan for full compliance assessmentConnect to a GCP project, validate credentials, and discover what services are in use.
Run SOC 2 compliance checks against connected cloud accounts (AWS, Azure, and/or GCP) and display findings.
Deep code scan for AI security issues — prompt injection, PII in prompts, hardcoded keys, unguarded agents.
Run AI governance checks across cloud accounts and code repos — ISO 42001, EU AI Act, NIST AI RMF compliance.
Walk staged changes against the engineering principles checklist and report pass/fail per principle. Run before any non-trivial commit. Catches doc drift, stub functions, single-region defaults, missing framework mappings, and other regressions before they ship.
Generate a public-facing security trust page from scan data. Produces a single deployable index.html that shows compliance framework scores, security policies, infrastructure overview, and data protection posture. Deployable to S3, Vercel, Netlify, or GitHub Pages.