🛡️ AegisGate Scanner v0.3.0 is LIVE — 268 regex patterns, CharCNN-BiLSTM ML detection, 8 output formats, SARIF, SBOM, GitHub Action, dual Docker images. View on GitHub (free, open source, Apache 2.0).

🛡️ AegisGate Scanner is a free, open-source static analysis scanner for AI artifacts. It detects prompt injection, secrets, PII, dangerous code, compliance violations, and OT/ICS exposure — before they reach production.

View on GitHub → Download v0.3.0 →

What Is AegisGate Scanner?

AegisGate Scanner is antivirus for AI artifacts. It performs static analysis on files destined for AI/ML pipelines — RAG documents, training datasets, model configurations, agent skills, and code generated by AI tools.

Every file you feed into an LLM is a potential attack vector. A training dataset can contain prompt injection payloads. A RAG document can hide secrets. A model config can expose OT/ICS systems. Scanner catches these risks before the artifact reaches your model.

Language: Go 1.26
License: Apache 2.0
Dependencies: Zero runtime dependencies
Performance: 1.88s per MB
Patent Pending: US Provisional App. No. 64/174,824

Detection Categories

Scanner uses a three-layer detection pipeline: keyword pre-filter → regex pattern matching → ML neural network.

Category	Patterns	What It Detects
🔐 Secrets	45	API keys, cloud credentials, private keys, database connection strings, OAuth tokens
🪪 PII	42	SSN, passport, driver’s license, credit cards, phone numbers, email addresses, IP addresses
💉 Prompt Injection	17	OWASP LLM-01 direct injections, jailbreak attempts, system prompt disclosure
📋 Compliance	47	HIPAA, PCI-DSS, GDPR, SOX, NIST, ISO 27001, CIS, FedRAMP, EFPIA, HITRUST
💣 Dangerous Code	48	SQL injection, command injection, XSS, path traversal, SSRF, eval/exec, deserialization
🌐 Web Security	33	OWASP Top 10, CSRF, open redirects, XXE, prototype pollution
🔌 OT/ICS	9	Modbus, DNP3, IEC 61850, ladder logic, HMI exposure, SCADA commands
🤖 AI/ML Security	18	Model poisoning, data exfiltration, membership inference, model inversion, adversarial examples
📊 Metadata Rules	21+247	Explicit + fallback rules for artifact classification (HuggingFace, PyTorch, ONNX, etc.)

Total: 268 regex patterns across 9 categories + CharCNN-BiLSTM ML detection

Three-Layer Detection Pipeline

flowchart LR subgraph Input["📥 Input"] A[AI Artifacts] A1[RAG Documents] A2[Training Data] A3[Model Configs] A4[Agent Skills] end subgraph Layer1["🔍 Layer 1: Keyword Pre-Filter"] B[O(log n) Lookup] B1[214 Keywords] B2[Fast Reject] end subgraph Layer2["🔎 Layer 2: Regex Detection"] C[268 Patterns] C1[9 Categories] C2[Compiled Regex] end subgraph Layer3["🧠 Layer 3: ML Detection"] D[CharCNN-BiLSTM] D1[1.6M Params] D2[<1ms CPU] end subgraph Output["📤 Output"] E[8 Formats] E1[SARIF] E2[JSON/JSONL] E3[CSV/HTML] E4[Text/Binary] end Input --> Layer1 Layer1 --> Layer2 Layer2 --> Layer3 Layer3 --> Output style Input fill:#1a1f2e,stroke:#38bdf8,stroke-width:2px style Layer1 fill:#1a1f2e,stroke:#f59e0b,stroke-width:2px style Layer2 fill:#1a1f2e,stroke:#06b6d4,stroke-width:2px style Layer3 fill:#1a1f2e,stroke:#8b5cf6,stroke-width:2px style Output fill:#1a1f2e,stroke:#10b981,stroke-width:2px

What Can Scanner Analyze?

Artifact Type	Extensions	Notes
Text documents	`.txt`, `.md`, `.rst`, `.pdf`	RAG documents, documentation
Code files	`.py`, `.js`, `.ts`, `.go`, `.java`, `.rs`, `.c`, `.cpp`	Training data, generated code
Config files	`.yaml`, `.yml`, `.json`, `.toml`, `.ini`, `.env`	Model configs, environment files
Data files	`.csv`, `.tsv`, `.jsonl`, `.xml`, `.html`	Training datasets
Model files	`.onnx`, `.pt`, `.pth`, `.safetensors`, `.bin`, `.h5`	Model weights (metadata scan)
Archives	`.zip`, `.tar`, `.tar.gz`, `.tgz`, `.tar.bz2`	Auto-extraction with bomb protection
AI artifacts	`config.json`, `pyproject.toml`, `adapter_config.json`	HuggingFace, PyTorch, ONNX, LoRA
Agent skills	`.json`, `.yaml`	MCP tool descriptions, agent prompts

Quick Start

Install

# Download from GitHub Releases
curl -L https://github.com/aegisgatesecurity/aegisgate-scanner/releases/latest/download/aegisgate-scanner-linux-amd64 -o aegisgate-scanner
chmod +x aegisgate-scanner

Scan a file

# Scan a single file
./aegisgate-scanner scan document.txt

# Scan a directory recursively
./aegisgate-scanner scan ./training-data/ --recursive

# Output SARIF for CI integration
./aegisgate-scanner scan ./rag-docs/ --format sarif --output results.sarif

GitHub Action

- name: AegisGate Scanner
  uses: aegisgatesecurity/aegisgate-scanner@v0.3.0
  with:
    path: ./data/
    format: sarif
    output: scan-results.sarif

Docker

# ML-enabled (with CharCNN-BiLSTM)
docker run --rm -v $(pwd):/data aegisgatesecurity/scanner:ml scan /data/

# Lite (regex-only, smaller image)
docker run --rm -v $(pwd):/data aegisgatesecurity/scanner:lite scan /data/

Key Features

Performance

1.88s per MB scan speed
O(log n) keyword pre-filter rejects clean files fast
Content-addressed caching — unchanged files skip re-scanning
Concurrent scanning — multi-core parallel processing

CI/CD Integration

SARIF 2.1.0 output for GitHub Code Scanning
8 output formats: SARIF, JSON, JSONL, CSV, HTML, Text, Binary, Go
GitHub Action for one-step CI integration
SBOM generation (CycloneDX, SPDX)
Exit codes for pipeline gating

Security

Zero runtime dependencies — no supply chain CVEs
Air-gapped capable — no network calls during scan
Archive bomb protection — size limits on extracted files
Baseline suppression — silence known/accepted findings

ML Detection

CharCNN-BiLSTM v13 — 1.6M parameters
< 1ms inference on CPU
No GPU required — runs on any machine
Heuristic fallback — works without model file

Who Uses Scanner?

Role	Use Case
ML Engineers	Scan training datasets before ingestion. Catch prompt injection, PII, and secrets in training data.
RAG Pipeline Builders	Scan documents before indexing. Prevent prompt injection from poisoned knowledge bases.
AI Agent Developers	Scan agent skills, tool descriptions, and prompts before deployment.
DevSecOps Teams	Integrate into CI/CD pipelines. Gate builds on security findings. SARIF for GitHub Code Scanning.
Compliance Teams	Map findings to 31 compliance frameworks. Generate audit-ready reports.
MLOps Teams	Scan model configs, weights metadata, and artifacts before model deployment.

Pricing

Tier	Price	Features
Community	Free forever	All 268 patterns, ML detection, 8 output formats, SARIF, GitHub Action
Professional	Contact us	Baseline management, custom rules, priority support
Enterprise	Contact us	SIEM integration, custom compliance frameworks, on-premise support

Scanner is free and open source (Apache 2.0). All detection capabilities are available in the community edition.

IP Notice

AegisGate Scanner is patent pending — US Provisional Application No. 64/174,824 (AI Artifact Static Analysis), filed October 12, 2026.

AegisGate Scanner — Antivirus for AI Artifacts