Contents

Connect

Scanners and uploads

Connect scanners in Integrations → Scanners (admins). Reports of the same vulnerability from different scanners (same repository, same package, a shared CVE or GHSA ID) become one finding that lists every source. When every scanner says a finding is fixed or dismissed, Akesis resolves it, and reopens it if a report returns. A status a person set is never changed by a scanner.

Dependabot

Comes with the GitHub connection. Akesis reads every Dependabot alert in the repositories the app can see, and reacts to new alerts within about 5 minutes; an hourly sync is the safety net.

Snyk

Under Snyk, enter your organization ID, region and a token: a Snyk App access token (any plan) or an Enterprise service-account or API token. Akesis checks it against the organization's projects before saving. Snyk projects map to repositories through their target URL; projects without one (for example CLI-monitored) are counted as unmapped. Snyk is read hourly, since its webhooks are an Enterprise beta.

Strix (AI penetration testing)

Strix runs in your own CI against your own staging environment, with your own model key; Akesis never runs it. Create an upload key under Strix, add the GitHub Actions step shown there, and each run posts its SARIF file to Akesis.

  • Dependency findings merge with Dependabot's and Snyk's.
  • Findings in your own code appear with their location, Strix's confidence, what the exploit showed and how to fix it, marked Exploit confirmed when Strix proved it. A confirmed exploit raises the priority; a later run that drops the confirmation takes that back.
  • Strix's exploit scripts are not in the SARIF file, so they never reach Akesis.

Any scanner that writes SARIF

Under SARIF uploads, create an upload key and add the step shown there to your CI after the scanner runs. Supported tools include Trivy, Grype and OSV-Scanner (vulnerable packages, merged with your other scanners) and CodeQL, Semgrep and Checkov (findings in your code and infrastructure files).

  • Send complete: true only for full scans of the default branch: findings the scan no longer reports are then resolved.
  • Secrets, licence results, code-quality rules and absolute build paths are left out.
  • Each key allows 60 SARIF uploads an hour.

Coverage from your CI

If a repository has a coverage floor (see Autonomy and policies), Akesis needs your CI to report line coverage for each commit. The SARIF upload key is used for this too: open SARIF uploads → Coverage step for a ready-to-paste GitHub Actions step.

  • Formats: lcov (lcov.info), istanbul (coverage-summary.json from Jest, Vitest, nyc or c8), cobertura (coverage.py, coverlet, PHPUnit), jacoco (jacoco.xml) and go (go tool cover -func).
  • Send it in the same job as your tests, so it arrives before the check finishes, and send the pull request's head commit (the step does this), not GitHub's temporary merge commit.
  • Akesis keeps only the percentage per commit, never the report.
  • Coverage uploads have their own allowance of 300 an hour.

Code structure from your CI

Akesis can show where each vulnerable package is used in your code: which files and functions import or call it, and who owns them by CODEOWNERS. It also shows which functions call those, so you can see the blast radius of a fix. It gets this from Graphify, run in your own CI. Integrations → SARIF uploads → Code structure step gives a ready-made GitHub Actions step. It:

  • runs on pushes to your default branch;
  • pins the Graphify version Akesis has checked;
  • runs Graphify with --code-only and GRAPHIFY_BACKEND=none, so it parses your code locally with tree-sitter, with no AI and nothing leaving your CI;
  • posts the resulting graph.json with your CI upload key.

Akesis keeps only which files and functions use each package (the latest upload per repository), not your code and not the graph. It refuses graphs in a format it hasn't checked.

It works for JavaScript and TypeScript, Python and Go. Rust is partly covered (some imports are missed), and Java isn't matched yet, because Graphify records only class names there. The result is context on a finding, never a reason to lower its priority.

Upload keys

Upload keys start with aks_, are shown once, and are stored only as a hash. Rotating a key replaces it immediately; disconnecting stops it working. Store it as a CI secret (the steps use AKESIS_SARIF_KEY or AKESIS_STRIX_KEY).