AI安全扫描

Install

Build from Source

git clone https://github.com/chainreactors/aiscan.git && cd aiscan

make                                                       # standard edition
make runner                                                # tag-free remote tool runner
make full                                                  # frontend + full edition

The standalone agent executable is no longer a maintained build or release target. Reference wiring remains in examples/agent and can be run manually with go run ./examples/agent --help. make full requires Node.js/npm and a working CGO toolchain; it builds the frontend first so the latest web/static assets are embedded into the binary. The native record tool is not included in the default full build; SDK and tool developers can build it explicitly with make record, as described in docs/record.md.

make web WEB_ADDR=127.0.0.1:18081 WEB_TOKEN=local-dev    # full build + Web UI

On Windows amd64, make and make full use the bundled static RE2 backend and statically link the MinGW runtime, producing a single executable without RE2, Abseil, libstdc++, libgcc, or winpthread DLLs.

---

Quick Start

```bash

Usage

LLM Configuration

```bash

Environment variable

export OPENAI_API_KEY="sk-..."

CLI arguments

aiscan agent --provider openai --base-url https://api.deepseek.com/v1 --api-key sk-... --model deepseek-chat

Config file `aiscan.yaml`:

context_window is a literal token count: use 128000, not 128K. Values below 8192 are accepted, but the Web UI warns that they may be too small. The request output limit is dynamically clamped to the remaining context: min(max_tokens, context_window - current_context - 4096). If no output space remains, AIScan returns a clear error instead of sending a one-token request. Automatic compaction starts as the context approaches the configured window.

---

Scan — Deterministic Pipeline

• Multi-stage auto-chaining: port discovery → web probing → weak credentials → POC detection — no LLM required
• Optional AI-driven result verification, public CVE correlation, and dynamic testing
• Quick mode for fast exposure mapping, full mode for deep crawl and extended coverage