# Compliance Scanner

A GitHub Action that scans pull requests for AI-agent governance gaps, missing audit trails, policy enforcement and human oversight, and posts a compliance report mapped to the EU AI Act, DORA and ISO 42001.

Compliance Scanner runs entirely inside a repository's CI runner. It reads the changed files in a pull request diff, performs static pattern matching for every Python file that imports an AI agent framework, and posts the resulting report as a pull-request comment through the GitHub API; it does not transmit code, prompts or agent context to any external service.

It checks five governance categories: audit trails such as logging and action logging, policy enforcement such as rate limits and scope restrictions, revocation capability such as kill switches and circuit breakers, human oversight, and related controls, with each detected gap accompanied by an actionable recommendation and a documentation link.

A separate Python SDK and JavaScript SDK are available for teams that want to send this data to a hosted or self-hosted compliance backend at runtime; by default they auto-detect the vendor's cloud service and send only a hash plus small metadata for data minimization, with a self-hosted deployment able to send full context to a server the operator controls.

Website: https://github.com/jagmarques/asqav-compliance