Skip to main content
Scanner connectors attach OpenLIT to job-based code scanners. Use them to scan a GitHub repository, collect findings with severity and path, and join those results to coding-agent traces. Add scanner connectors from Configuration → Connectors (/connectors) under the Scanners category, or from the Scanner page (/scanner) when no connector exists yet. Connectors are scoped to the current project and environment.
Scanner connectors use the same atomic registry as data-source and memory connectors. They do not participate in telemetry signal routing. GitHub tokens are encrypted on the connector instance.

​
Mental model

  • Atomic connectors — one Trustabl scanner per connector instance, with its own target, defaults, and token.
  • GitHub URL target — v1 scans https://github.com/owner/repo only. Local filesystem paths are rejected.
  • On-demand CLI — OpenLIT installs a checksum-verified Trustabl release onto the server, then runs trustabl scan.
  • Environment-scoped jobs — jobs and findings stay on the connector for the selected environment.

​
Supported scanner connectors

​
Add a Trustabl scanner

1

Select project and environment

Use the header selectors for the target project and environment.
2

Open Connectors or Scanner

Go to Configuration → Connectors and choose Add connector, or open Scanner (/scanner) and add a connector from the empty state.
3

Pick Trustabl

Select Trustabl from the Scanners category.
4

Set the repository and token

Enter an https://github.com/owner/repo URL. Add /tree/branch to pin a branch, or set Ref separately. Add a GitHub token for private repositories.
5

Install the CLI and run a scan

On the Scanner page, install the Trustabl CLI onto the OpenLIT server, then Run scan. Findings appear on the same page.
Rules source Follow environment maps this OpenLIT environment: production → signed production, staging → signed staging, development → unsigned git.

​
Scanner page

Once a connector is configured, Scanner (/scanner) provides:

​
Scan parameters

Connector defaults apply when you run with defaults. Override them for one job from Run with new parameters.

​
Coding agents and Otter

Coding-agent spans stamp vcs.repository.url.full. OpenLIT matches that URL to the latest succeeded scan in the current project and environment (https, git@, .git, and /tree/<ref> forms).
  • The coding-agent trace detail page shows a Scanner tab when a repo URL is present.
  • Otter can call get_scanner_findings with the GitHub URL. Medium+ findings are listed first.

​
API

Authenticate with an OpenLIT API key and send organisation, project, and environment headers. See Settings → OpenAPI Spec for the interactive catalog. POST /api/scanners/{id}/scan can take several minutes (up to 300 seconds). A second scan is rejected while one is already running on the same connector.

​
Security

  • Scan targets are GitHub HTTPS URLs only. Local paths, SSH URLs with credentials, and whitespace are rejected.
  • Tokens are encrypted on the connector (enc:v1:…), redacted from jobs and API responses, and never logged.
  • The Trustabl CLI download is checksum-verified before install.

Connectors overview

Shared connector registry and project scope.

Data-source connectors

Tempo, Loki, Prometheus, Jaeger, and ClickHouse.

Memory connectors

Claude, Mem0, and Zep for agent memory.

Coding agents

How coding-agent traces expose vcs.repository.url.full.