Overview

The DigitalOcean inspector is an AI-agent governance inspector first, and a cloud-inventory inspector second. Its primary surface is DigitalOcean's Gradient (GenAI) Platform — the AI agents a team has deployed, the models and system prompts behind them, whether any are publicly exposed as a chatbot, and their knowledge bases. Its secondary surface is DigitalOcean's traditional cloud inventory: Droplets, Kubernetes clusters, managed databases, App Platform apps, load balancers, and more, collected per Project. A Partner connects one DigitalOcean Personal Access Token per Customer team; Liongard discovers each DigitalOcean Project in that team as a child launchpoint mapped to a Customer Environment.

DigitalOcean is a developer-focused public cloud. Beyond compute, storage, and networking, it now runs the Gradient AI Platform (formerly the "GenAI Platform"), letting a team deploy AI agents with attached models, retrieval knowledge bases, and optional public chatbot endpoints. DigitalOcean organizes a team's resources — including its AI agents — into Projects, which is the unit Partners use to slice a team per Customer.

Inspector Setup Preparation

The credential is a DigitalOcean Personal Access Token created in the DigitalOcean Control Panel. You'll need access to the Customer's DigitalOcean team with permission to create API tokens, and the token must carry the GenAI / AI Agents read scope for the primary AI surface to work.

1. Sign in to the DigitalOcean Control Panel and select the target team in the top team dropdown.
2. Go to API (left navigation) → Tokens tab → Generate New Token.
3. Enter a token name (for example, "Liongard"), set an expiration if desired, and choose Custom Scopes.
4. Enable Read access for GenAI / AI Agents plus Account, Billing, Droplet, Kubernetes, Database, App, Block Storage, Load Balancer, Firewall, VPC, Domain, Project, CDN, Image, Snapshot, SSH Key, Tag, and Container Registry — or select Full Access read-only for simplicity.
5. Select Generate Token.
6. Copy the token immediately — it is shown only once.

Liongard Inspector Setup

Step 1: Parent Inspector Setup

Since DigitalOcean is a multi-tenant system where a single Customer team can hold many Projects, you will set up a single "Parent" Inspector with the DigitalOcean Personal Access Token, which will then auto-discover a "Child" Inspector for each Project.

In Liongard, navigate to Admin > Inspectors > Inspector Types > Navigate to the DigitalOcean Inspector > Select Add System.

Fill in the following information:

• Type of Inspector: Parent
• Environment: Select your MSP's Environment
• Friendly Name: Suggested Naming: Environment Name [DigitalOcean] Parent
• Agent: Select an On-Demand or Self-Managed agent
• DigitalOcean API Token: Paste the Personal Access Token created during Inspector Setup Preparation
• Inspector Version: Latest (Auto-Update)
• Scheduling: The Inspector will default to run once a day at the time the Inspector is set up. Here you can adjust the schedule.

Select Save. The Inspector will now be triggered to run within the minute.

Step 2: Child Inspector Setup

After the first run of the Parent Inspector, your client's DigitalOcean Projects will be Auto-Discovered and surfaced on the Discovered Systems page.

Navigate to the Discovered Systems tab in your Inspectors > DigitalOcean page.

• Activate your Discovered Systems by ensuring they're mapped to the correct Environment > Select the checkbox to the left of Inspector(s) > Select the Actions drop-down menu > Activate Launchpoints.
• Users may also Archive Discovered Systems by selecting the checkbox to the left of the Inspector(s) > Select the Actions drop-down menu > Archive Launchpoints.

Troubleshooting

• AI Agents tab is empty — the token lacks the GenAI read scope (the endpoint returns 403, which the inspector ignores); re-issue the token with the GenAI / AI Agents read scope.
• No billing figures — the token lacks the billing read scope (403, ignored); re-issue with billing read.
• "Invalid or revoked token" — the token failed validation on the account probe (401); re-issue the token and update the launchpoint.
• No container registry shown — the team has no container registry (404, treated as "none").