Skip to main content
Connect a GitGuardian workspace to let CloudThinker agents list and triage secret incidents, trace each exposed credential to its sources and occurrences, and review honeytokens. The connection signs in with a GitGuardian Personal Access Token (PAT) plus your dashboard URL, so the same setup works for the US, EU, and self-hosted instances.

Prerequisites

  • A GitGuardian workspace that holds the incidents you want agents to read.
  • Permission to create a Personal Access Token in that workspace.
  • The Admin role in your CloudThinker workspace, which can add and edit connections. See Roles.
  • Your dashboard URL. Use the address you sign in at:

Setup

1

Create a Personal Access Token

Sign in to GitGuardian. In the sidebar, open Settings → API → Personal Access Tokens and click Create token:
  • Name: cloudthinker
  • Expiration: pick a date that matches your rotation policy
  • Scopes: tick the read variant of incidents, secrets, and sources (for example incidents:read). That covers the verify and example prompts. Add others from Required permissions only if you need them.
Copy the token right away. GitGuardian shows it once.
2

Add the connection in CloudThinker

In the sidebar, click More → Workspace settings → Connections, stay on the Builtin Connections tab, and select GitGuardian. Fill in:
  • GITGUARDIAN_URL: your dashboard or instance URL from the table above
  • GITGUARDIAN_PERSONAL_ACCESS_TOKEN: the token you just created
Click Connect.Success state: GitGuardian shows Connected in the Connections list. Then open a new chat and send the verify prompt to confirm the token’s scopes.
If you lose the token, you can’t view it again. Create a new one in GitGuardian and paste it into the connection.

Connection details

To reach a second GitGuardian workspace, add it as a separate connection with its own token.

Required permissions

Each PAT scope unlocks one family of agent capabilities. Where GitGuardian offers a :read and a :write variant, pick :read. If an agent says it can’t do something, the token is usually missing that scope.
A PAT also inherits the workspace role of the person who creates it. Create it from the least-privileged member who still has the access you need, and pick read access whenever a scope offers it.

Agent capabilities

Reads run without asking. Creating a honeytoken needs honeytokens:write and a token created by a Manager, and it only happens when you ask for it. Every change an agent makes goes through your workspace’s Approvals first. On the default Auto · Rules + AI · Ask me mode, AI judgment can let a safe change run without asking — and an Allow Rule can too, once CloudThinker turns on Rule enforcement for your workspace. Choose Manual to approve every change yourself. To be asked before every honeytoken is created, choose Manual. Once CloudThinker turns on Rule enforcement for your workspace, an Ask first Rule can single out honeytoken creation.

Verify the connection

Expect the list of scopes on the token and a count of open incidents, meaning incidents in Triggered or Assigned status. A scope you expected but don’t see means the token needs updating.

Example prompts

Troubleshooting

The token is wrong, expired, or revoked. Create a new Personal Access Token. In More → Workspace settings → Connections, open GitGuardian, click the pencil icon on the connection’s row, click Replace…, paste the token into GITGUARDIAN_PERSONAL_ACCESS_TOKEN, and click Save and test.
The token lacks the scope for that request, or its creator’s workspace role is too low. Add the scope in GitGuardian (honeytoken creation needs Manager), then update the connection with the new token.
The token is missing the matching scope. Compare the request against Required permissions, create a token with that scope, and update the connection.
GITGUARDIAN_URL points at the wrong region or instance. A US token doesn’t work against the EU dashboard. Use the exact address you sign in at.

Security

  • Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
  • Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
  • Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
  • Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.
  • Read scopes first: add honeytokens:write or a Manager-role token only if you want agents to create honeytokens.
  • Dedicated token: name it cloudthinker so you can revoke it in GitGuardian without breaking other tools.

Semgrep Connection

Scan files and read your Semgrep code findings.

Approvals

Control which GitGuardian changes wait for a person.