Can Complipath find the AI in our GitLab code with a read-only token?

How you connect it

• An admin of the workspace makes an access token in GitLab, personal or for a group, with the scopes read_api and read_repository and the role Reporter, and pastes it in. For your own GitLab, its https address goes with it.
• The token is checked before it is kept. One that can write is refused with the scope named, so is one without read_api, and so is one that lists projects but cannot open their files.
• Your own GitLab must be reachable from the internet at an https address. An address on a private network, one only your own office or machine can reach, is refused.
• The first read starts by itself and shows its progress, then one result line. After that you press Check now.

What it reads

• The default branch of each project the token is a member of, up to 500 projects. Archived projects and projects with no default branch are left out.
• Each project comes down as one archive that is read once, file by file. It opens dependency files such as package.json, requirements.txt and go.mod, and source files in languages such as Python, TypeScript, Go and Java.
• In them it looks for AI libraries in dependencies and imports, calls to AI service addresses such as api.openai.com, model names such as gpt-4o, and AI key names such as OPENAI_API_KEY. Never the value after a key's name.
• A comment line is passed over, and so is a line that lists the addresses of three or more AI companies at once, because that describes AI rather than calling it.

What it skips and what it cannot see

• Test files, vendored or built code, lock files and minified files.
• Secret files such as .env and key files (.pem, .key, .p12, .pfx) are never opened. A .env.example file is read, for the names in it only.
• Files over 200 KB, documents and images. A project past 20,000 code files or 400 MB is marked partly read, never as a read that found nothing.
• Other branches, and anything the token cannot reach. A GitLab inside your network needs the scanner in your own CI instead, which is part of Growth, not available yet.

What you see and what it keeps

• One result line, such as Found 2 AI systems in 14 repositories · We read 1,284 files. A project that could not be read says why and is tried again at the next check.
• What we found: each suggested AI system with its file and line, and two buttons, Add to register and Ignore. Projects whose names differ only by a suffix such as -api or -web become one suggestion.
• Nothing enters the register until a person adds it, and an added system counts toward your plan's limit of AI systems.
• It keeps the project, file, line, matched name and vendor, never the code around them. Disconnecting removes Complipath's access at once, and you choose whether the findings stay.

Which plan

Starter and up. The trial includes it; the free plan does not.

On Starter, a read runs when you connect and when you press Check now, once a day per connection. Reading every hour and after each push is watching, part of Growth, which is not available yet.

Where it sits in the law

• It is not an EU AI Act duty. Reading code finds candidates. Whether one is an AI system as defined in Article 3, point (1) of Regulation (EU) 2024/1689 is for a person to decide.
• A match is a name in a file. It does not show that the code runs in production, or what data reaches it.