AI systems consume artifacts the same way software systems consume dependencies. RAG documents, training datasets, model configurations, and agent skills are all inputs that shape what your AI does. A single poisoned document can inject malicious prompts, exfiltrate secrets, or cause model misbehavior.
I'm the solo founder of AegisGate Security, and I just released AegisGate Scanner v0.3.0 — a static analysis tool that scans AI artifacts for security threats before they reach production.
268 detection patterns. 9 categories. 8 output formats. Apache 2.0. No telemetry.
Here's what it does and how to use it.
Why I Built This
I looked at the existing tooling landscape and found a gap:
| Threat | Semgrep / CodeQL | TruffleHog / Gitleaks | AegisGate Scanner |
|---|---|---|---|
| Prompt injection | ❌ | ❌ | ✅ 17 patterns + ML |
| Secrets | Partial | ✅ | ✅ 64 patterns |
| PII (US + International) | ❌ | ❌ | ✅ 85 patterns |
| Dangerous code (agent skills) | Partial | ❌ | ✅ 34 patterns |
| Compliance (HIPAA/GDPR/EU AI Act) | ❌ | ❌ | ✅ 47 patterns |
| OT/ICS protocol exposure | ❌ | ❌ | ✅ 9 patterns |
| Archive extraction | ❌ | ❌ | ✅ zip/tar.gz/tar.bz2 |
| SARIF output | ✅ | ❌ | ✅ |
| ML-based detection | ❌ | ❌ | ✅ |
| SBOM generation | ❌ | ❌ | ✅ SPDX |
Semgrep and CodeQL are excellent for code-level dataflow analysis. TruffleHog and Gitleaks are great at finding secrets. But none of them scan for prompt injection embedded in a RAG corpus, or dangerous function calls hidden in an agent skill file, or PII leaking through a training dataset.
Scanner isn't a replacement for those tools — it's a complementary tool purpose-built for the AI artifact attack surface.
Quick Start: 30 Seconds to Your First Scan
# Install (curl — one-line installer with checksum verification) curl -fsSL https://raw.githubusercontent.com/aegisgatesecurity/aegisgate-scanner/main/install.sh | bash # Or via Homebrew brew install aegisgatesecurity/tap/aegisgate-scanner # Or from source go install github.com/aegisgatesecurity/aegisgate-scanner/cmd/aegisgate-scanner@latest # Scan a directory aegisgate-scanner scan ./my-project # Self-test (verify installation, scan own codebase) aegisgate-scanner doctor That's it. No config file required. No API keys. No telemetry. It just scans.
What It Detects
268 regex patterns across 9 categories, plus an optional neural detection layer:
| Category | Patterns | Examples |
|---|---|---|
| Prompt Injection | 17 | "Ignore all previous instructions", SSTI probes, base64-encoded payloads, indirect injection |
| Secrets | 64 | AWS keys, GitHub tokens, OpenAI keys, Stripe keys, Slack tokens, JWT, private keys |
| PII — US Core | 32 | SSN, email, phone, passport, driver's license, ITIN |
| PII — US Extended | 13 | Employer ID, VIN, bank routing, Medicare, NAIC |
| PII — Financial | 16 | Credit cards (Visa/MC/Amex/Discover), IBAN, SWIFT/BIC |
| PII — International | 24 | UK NHS, Canada SIN, Germany Steuer, France INSEE, Australia TFN |
| XSS | 12 | Script injection, event handlers, encoded payloads, SVG vectors |
| Compliance | 47 | OWASP LLM Top 10, EU AI Act, MITRE ATLAS, HIPAA, GDPR, COPPA, CCPA |
| Dangerous Functions | 34 | eval(), exec(), os.system(), subprocess, pickle.load(), child_process.exec() |
| OT/ICS Protocols | 9 | Modbus, S7comm, DNP3, BACnet, EtherCAT, OPC UA, Profinet |
| ML (optional) | 1 model | Neural detector for adversarial prompt injection variants |
The ML layer is optional and additive. The scanner ships in two builds: a lite build (pure Go, no CGO, ~20MB Docker image) and an ML build (with ONNX Runtime, ~150MB). Both share the same 268 regex patterns.
CI/CD Integration: GitHub Action
This is where Scanner shines. Add it to any workflow and get SARIF results in GitHub's code scanning UI:
name: AegisGate Scanner on: [push, pull_request] jobs: scan: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: aegisgatesecurity/aegisgate-scanner@v0 with: path: '.' format: 'sarif' severity: 'medium' - uses: github/codeql-action/upload-sarif@v4 with: sarif_file: aegisgate-report.sarif The Action is live on the GitHub Marketplace. Use @v0 for auto-updating to the latest major version, or pin @v0.3.0 for reproducibility.
Available inputs:
| Input | Default | Description |
|---|---|---|
path | . | Directory to scan |
format | github | Output format |
severity | medium | Minimum severity threshold |
no-ml | false | Disable ML detection |
diff | false | Show only new findings |
baseline | — | Baseline file path for diff |
disable-rule | — | Rules to disable (comma-separated) |
concurrency | 0 | Parallel workers |
no-extract-archives | false | Disable archive extraction |
Docker: Two Images for Different Use Cases
# ML-enabled (full detection, ~150MB) docker build --target ml -t aegisgate-scanner . docker run --rm -v $(pwd):/github/workspace aegisgate-scanner scan /github/workspace # Lite (heuristic-only, ~20MB, distroless — no shell, no package manager) docker build --target lite -t aegisgate-scanner:lite . docker run --rm -v $(pwd):/github/workspace aegisgate-scanner:lite scan /github/workspace The lite image is distroless — no shell, no package manager, minimal attack surface. Perfect for CI pipelines where you want the smallest possible image and don't need ML detection.
8 Output Formats
Scanner supports 8 output formats out of the box. Here's when to use each:
# Text — terminal / human-readable (default) aegisgate-scanner scan ./project # JSON — programmatic / API integration aegisgate-scanner scan ./project --format json -o results.json # JSONL — NDJSON for Splunk, ELK, Datadog aegisgate-scanner scan ./project --format jsonl -o findings.jsonl # SARIF — GitHub Code Scanning / CI/CD aegisgate-scanner scan ./project --format sarif -o results.sarif # HTML — reports / email / sharing aegisgate-scanner scan ./project --format html -o report.html # PR Comment — pull request comment (markdown table) aegisgate-scanner scan ./project --format pr-comment # GitHub Actions — PR annotations in CI aegisgate-scanner scan ./project --format github-actions # SBOM — SPDX software bill of materials aegisgate-scanner scan ./project --format sbom -o sbom.spdx.json Advanced Features Worth Knowing About
Archive Extraction with Bomb Protection
Scanner extracts and scans inside .zip, .tar.gz, and .tar.bz2 archives:
aegisgate-scanner scan ./project --extract-archives Archive bomb protection enforces a 100MB extraction limit and 10,000 file count limit. Path traversal (Zip Slip / Tar Slip) is blocked. This is important — an attacker could hide a poisoned document inside a seemingly innocuous archive in your RAG corpus.
Baseline Suppression for CI/CD Gating
Don't let pre-existing findings block your pipeline. Create a baseline, then scan for only new findings:
# First run — create baseline aegisgate-scanner scan ./project --format json -o baseline.json # Subsequent runs — only new findings aegisgate-scanner scan ./project --diff --baseline baseline.json This is the pattern I recommend for CI/CD gating: scan on every PR, but only fail the build on new findings. Pre-existing issues can be tracked and remediated separately.
Content-Hash Caching
Skip re-scanning unchanged files across runs:
aegisgate-scanner scan --cache . Results are cached by SHA-256(content) — renamed files still hit the cache. Only content changes, pattern changes, or scanner version bumps invalidate the cache. In a monorepo with thousands of files, this makes incremental scans near-instant.
Git History Scanning
See when findings were introduced:
aegisgate-scanner scan-history ./project Scans commit-by-commit, showing when a secret or prompt injection was first added and by whom. Useful for incident response and audit trails.
Stdin/Pipe Mode
Scan piped content without writing to a file:
cat suspicious_agent_skill.py | aegisgate-scanner scan - --stdin-ext .py curl -s https://example.com/rag-doc.md | aegisgate-scanner scan - --stdin-ext .md Custom Patterns
Add your own detection patterns via .aegisgate.yml:
custom_patterns: - name: "custom_api_key" regex: "MY_KEY_[a-zA-Z0-9]{32}" severity: "high" description: "Custom API key format" Disable Specific Rules
aegisgate-scanner scan ./project --disable-rule secret_aws_key --disable-rule pii_ssn Performance
The v0.3.0 release included a performance sprint. Here are the numbers:
| Input Size | Latency | Throughput |
|---|---|---|
| 1 KB | 18.7 ms | ~53 KB/s |
| 100 KB | 0.19 s | ~526 KB/s |
| 1 MB | 1.88 s | ~532 KB/s |
| 10 MB | 18.8 s | ~532 KB/s |
That's a 12x improvement over v0.2.0 (was 12.7s/MB, now 1.88s/MB), achieved through line-by-line keyword pre-filtering and binary-search line/column lookup. Latency scales linearly with input size.
The 1 KB case (~19ms) is fast enough for real-time IDE integration. A self-scan of the scanner's own codebase (61 Go files) completes in 5.8 seconds with 14 MB peak memory.
Testing
I take testing seriously. The scanner has:
| Test Type | Count | Description |
|---|---|---|
| Unit tests | 1,080+ | Per-function correctness |
| Benchmark tests | 8 | Performance regression detection |
| Fuzz tests | 6 | Random input crash detection |
| Race tests | 7 | Concurrent access validation |
| Archive security tests | 12 | Bomb/traversal/symlink protection |
| Evasion suite | 1 | 50 transforms × 52 adversarial payloads |
| E2E tests | 10 | Full pipeline integration |
All 9 testable packages maintain ≥90% coverage. The race detector runs in CI. Fuzz testing runs in CI.
Configuration
Create .aegisgate.yml in your project root:
# Paths to ignore (glob patterns) ignore_paths: - "node_modules" - "vendor" - "dist" - "*.test" # File extensions to scan (empty = all supported) extensions: [] # Severity threshold (critical, high, medium, low) severity: "medium" # Enable ML detection (requires CGO build) ml: false # Parallel workers concurrency: 0 # Extract archives before scanning extract_archives: false # Custom patterns custom_patterns: - name: "custom_api_key" regex: "MY_KEY_[a-zA-Z0-9]{32}" severity: "high" description: "Custom API key format" Exit Codes
| Code | Meaning |
|---|---|
| 0 | No findings (clean) |
| 1 | Findings detected |
| 2 | Scanner error (invalid path, config error, etc.) |
This makes it trivial to gate CI pipelines:
aegisgate-scanner scan ./project --format sarif -o results.sarif && echo "Clean" || exit $? Where It Fits in the AegisGate Ecosystem
Scanner is one of four AegisGate products, each addressing a different layer of the AI security stack:
- AegisGate Platform — Server-side gateway. Intercepts live API calls, 223 detection patterns, 30+ compliance frameworks. For teams running AI in production.
- AegisGate Rampart — Free local proxy. Intercepts secrets before they leave your machine when using AI coding tools. For individual developers.
- AegisGate MCP — Secure MCP server framework with 23 security layers. For teams building MCP servers.
- AegisGate Scanner — Static analysis for AI artifacts. Runs in CI/CD or locally. Scans files before they reach your AI system.
Scanner is the shift-left complement to our runtime products. Scan files before they enter your AI pipeline, not after.
What's Next
v0.3.0 is the first public release. On the roadmap:
- Scanner-specific corpus evaluation with dedicated test corpora
- Competitive benchmark report against TruffleHog, Gitleaks, and Semgrep
- Transformer-based ML model upgrade (DistilBERT/BERT)
- Multimodal artifact support (image-based prompt injection)
- Streaming scan mode for very large files
- Additional archive formats (.7z, .rar)
Try It
curl -fsSL https://raw.githubusercontent.com/aegisgatesecurity/aegisgate-scanner/main/install.sh | bash aegisgate-scanner scan ./my-project - GitHub: aegisgatesecurity/aegisgate-scanner
- Marketplace: AegisGate Scanner Action
- Website: aegisgatesecurity.io/scanner/
- License: Apache 2.0
If this is useful, star the repo. It helps others discover it.
Secure Every AI Interaction.
Josh Colvin is the founder of AegisGate Security, building open-source, self-hosted AI security. Apache 2.0. No telemetry. No data egress.
