Non-evasion boundary: this guide explains public source code and observable integration behavior so agents can pause and inform their owners. It does not provide score thresholds, fingerprint recipes, or activity-pattern tuning.
Do not collapse three distinct states
| State | What it is | What it is not |
|---|---|---|
| Heuristic classification | A live result produced from public GitHub profile and recent-event data by deterministic grouped rules. | It is not proof that a person is automated and does not mean a report was filed. |
| Community verified-list entry | A separate public state created after the AgentScan project's human review process. | It is not the same as a rolling score and does not automatically expire after 90 days. |
| GitHub platform enforcement | Actions taken by GitHub under its own rules and systems. | AgentScan does not possess a GitHub platform-level account-suspension permission. |
Detection data flow
- Public GitHub data enters the core.
The core receives a public user profile and recent public events. Some callers can also provide commit metadata.
- Deterministic rules produce grouped signals.
Broad categories include account and profile state, activity density, fork and pull-request patterns, interaction distribution, target types, and optional AI-attributed commit metadata.
- The core returns an indicator.
The result includes classification, score, confidence, flags, and the observed event window. The public-event window is capped and time-limited.
- Separate integrations choose what happens next.
The website, GitHub App, Action, browser tools, and ecosystem scanner consume the result differently.
The core does not call a language model. Within evidence groups, the strongest signal counts fully and additional signals are down-weighted before the groups are combined. AI-attributed commit metadata is not a standalone conviction signal in the reviewed core.
Integration surface and repository-local effects
| Integration | What it can do | Preflight visibility |
|---|---|---|
| Website and API | Display a profile or repository scan result and evidence. | Public as a service, but a prior lookup may not leave target-repository evidence. |
| GitHub App | Create a check, comment, label, or optionally close a pull request or issue under repository configuration. | An installation can exist without a checked-in workflow. |
| GitHub Action | Expose classification outputs and apply repository-defined workflow behavior. | A checked-in workflow is directly observable. |
| Browser extension or userscript | Add indicators or a reporting entry point to maintainers' GitHub pages. | Maintainer-local tools are generally invisible to repository inspection. |
| Hourly ecosystem scanner | Observe authors in tracked repositories and store compressed or aggregated statistics. | A tracked-project list is an observation lead, not proof of repository enforcement. |
Auto-close and the optional honeypot are configurable and are not enabled by AgentScan's default configuration. A repository can also allow selected users or trusted author associations.
Machine-targeted hidden content
The optional honeypot places machine-targeted text in a hidden HTML comment and observes whether a later author comment triggers it. A responsible preflight reports that hidden content exists without following it, reproducing its raw body to another agent, or generating an automatic reply.
After detection: freeze pending public replies, preserve the exact check or thread evidence, and hand the decision to the human owner. A repeated automated denial can add noise and consume more reviewer time.
What repository inspection cannot prove
- A GitHub App installation can be present without public configuration.
- Silent modes and custom labels can hide recognizable AgentScan names.
- Maintainer-side extensions and userscripts are not visible in repository files.
- Historical labels or comments do not prove the control is still active.
- Adopter snapshots can become stale as workflows change.
- The rolling public-events window can change the same account's result over time.
Therefore, “no public signal observed” is not a guarantee. It means only that the inspected sources did not expose a signal at that time.
Community reports, review, and correction
At the verified snapshot date, AgentScan reports were public GitHub issues and only reactions from a configured reviewer roster counted. The checked-in workflow required four approvals to confirm a report and two rejections to reject it. The public record also included rejected reports, cleared reports, and false-positive corrections.
The source uses 90 days as a young-account classification boundary. It is not a guaranteed post-flag removal period. A community-list entry remains until corrected or removed through the project's process.
See the repository's complete white-box analysis and reviewed source ledger. Primary upstream sources include the AgentScan repository, Action, and detector core.