AI Security Scanner

Table of Contents

1. Purpose

2. Quick Start

3. Usage

Purpose

The AI Security scan analyzes the project's source tree to detect security risks on the AI components used by the application (prompts, agents, skills, tools, guardrails, vector stores), classified under the OWASP LLM Top 10 (2025). It is a static scan: it runs in CI/CD or on a local checkout, with no runtime probes and no software required on developer endpoints.

Quick Start

Use the following command to detect AI Security risks in the current directory and upload the results to the Xygeni Platform:

xygeni ai -n MyProject --dir . --upload

The AI Security scanner can be run in two different ways:

• Running its own specific command ( xygeni ai [options], also available as xygeni aisecurity [options] )

• Running the general command ( xygeni scan --run="ai" [options] )

Restrict the scan to a given OWASP LLM Top 10 category, and save the report to a local file:

xygeni ai -n MyProject --dir . --owasp LLM01 \
          --output MyProject.ai.json

Usage

The AI Security Scanner is launched using the xygeni ai [options] command.

To view all available options, use the --help flag:

xygeni ai --help

The most important properties are:

• Name of the Xygeni Project -n or --name. When not provided, it is inferred from the directory name.

• Input source to analyze, specified as a directory with -d or --dir.

• Upload results to the service --upload. By default, results are not uploaded and the report is written to the standard output.

• Output file (-o or --output) and format (-f or --format). The AI Security scanner currently exports JSON only; other formats are normalised to JSON with a warning.

• Specify what detectors to run with the --detectors / --skip-detectors options.

• Restrict the scan to specific OWASP LLM Top 10 categories with the --owasp option.

Configuration options:
  -c, --conf=<config>        Configuration file (default: built-in xygeni.aisecurity.yml).
      --[no-]conf-download   Download scanner config? (default: true)
      --detectors=<list>     Comma-separated list of detector IDs to run (overrides config).
                             'all' for everything enabled.
      --skip-detectors=<list>
                             Comma-separated list of detector IDs to ignore.
      --owasp=<list>         Comma-separated list of OWASP LLM Top 10 categories to include
                             (LLM01..LLM10). Empty = all.
      --custom-detectors-dir=<customDetectorsDir>
                             Optional directory with custom-detector *.yml files.

By default, the command exits with a non-zero code when at least one AI Security finding is raised (useful for build gating). Use --never-fail to always return a success exit code regardless of the findings.

For the details of the scanner configuration file and the optional LLM semantic review stage, see AI Security Scanner Configuration. For the catalogue of detections, see AI Security Detectors.