Skip to main content

Console operators

Day-two guide for AppSec and platform owners on the hosted console (guard.unveilr.ai or your self-host URL).

First hour​

  1. Sign in via your org’s SSO path.
  2. Overview (/) — coverage rollup (repos scanned, findings needing action, enforce %, agent gate). One API call; refresh after you connect repos.
  3. Repositories → Install GitHub App — only enabled when the platform App is verified. Prefer Add or update GitHub access if GitHub already shows the App installed but this workspace is unbound.
  4. Scan a connected private repo. Private clones use a short-lived installation token — never a shared PAT.

GitHub App permissions (fix PRs)​

Remediation Open fix PR needs write on the installation:

PermissionLevel
ChecksRead and write
ContentsRead and write
Pull requestsRead and write
MetadataRead-only

After the App’s permissions change on GitHub, open the installation settings and Accept the update. App-level write with installation-level read still returns 403 on POST …/pulls.

Platform super-admins create/wire the global App under Settings → GitHub App (manifest → durable secret → API roll). Tenant admins only install it.

Findings → fix​

  1. Findings — filter “Needs action”; open a row for code context + history.
  2. Open fix PR (when available) — Unveilr opens a branch/PR via the App.
  3. Remediation hub (/remediation) — ticket + PR actions in one place.

Registry & bulk approve​

  • Registry — register MCP servers, approve tools, quarantine drift.
  • When policies allow a set of discovered tools, use Approve N (policy-engine bulk approve — same forbid-overrides brain as the gateway).
  • AI Inventory → Promote to registry turns a discovered mcp.json server into a registry draft (discovered until approved).

Agents & external identity​

  • Settings → Identity Providers — enterprise path: Okta XAA / Entra Agent ID / OIDC. Use Discover for JWKS, set audience, enable/disable, Refresh JWKS after key rotation. See Enterprise agent identity.
  • Agents — register → Bind IdP & approve (preferred) or lab-mint uvt_ / revoke (kill switch). IdP JWT works on Gateway and govern/check.

Prove​

  • Evidence — verify the hash chain; export NDJSON.
  • Compliance — framework coverage + human attestations; download printable packs where offered (e.g. EU AI Act).

Ops settings​

PathWhoPurpose
/settingsTenant adminOrg, notifications, tokens, integrations
/settings/identity-providersTenant adminExternal agent IdPs
/settings/github-appPlatform super-adminCreate/wire the production GitHub App