> For the complete documentation index, see [llms.txt](https://docs.xygeni.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.xygeni.io/xygeni-products/ai-security/ai-security-scanner.md).

# AI Security Scanner

## Table of Contents

1. [Purpose](#purpose)
2. [Quick Start](#quick_start)
3. [Usage](#usage)

### Purpose <a href="#purpose" id="purpose"></a>

The **AI Security scan** analyzes the project's source tree to **detect security risks on the AI components** used by the application (prompts, agents, skills, tools, guardrails, vector stores), classified under the **OWASP LLM Top 10 (2025)**. It is a **static** scan: it runs in CI/CD or on a local checkout, with no runtime probes and no software required on developer endpoints.

### Quick Start <a href="#quick_start" id="quick_start"></a>

Use the following command to detect AI Security risks in the current directory and upload the results to the Xygeni Platform:

```bash
xygeni ai -n MyProject --dir . --upload
```

{% hint style="info" %}
The AI Security scanner can be run in two different ways:

* Running its own specific command ( `xygeni ai [options]`, also available as `xygeni aisecurity [options]` )
* Running the general command ( `xygeni scan --run="ai" [options]` )
  {% endhint %}

Restrict the scan to a given OWASP LLM Top 10 category, and save the report to a local file:

```bash
xygeni ai -n MyProject --dir . --owasp LLM01 \
          --output MyProject.ai.json
```

### Usage <a href="#usage" id="usage"></a>

The AI Security Scanner is launched using the `xygeni ai [options]` command.

To view all available options, use the `--help` flag:

```bash
xygeni ai --help
```

The most important properties are:

* **Name** of the Xygeni Project `-n` or `--name`. When not provided, it is inferred from the directory name.
* **Input source** to analyze, specified as a **directory** with `-d` or `--dir`.
* **Upload** results to the service `--upload`. By default, results are not uploaded and the report is written to the standard output.
* **Output file** (`-o` or `--output`) and **format** (`-f` or `--format`). The AI Security scanner currently exports **JSON** only; other formats are normalised to JSON with a warning.
* Specify what detectors to run with the `--detectors` / `--skip-detectors` options.
* Restrict the scan to specific **OWASP LLM Top 10 categories** with the `--owasp` option.

```bash
Configuration options:
  -c, --conf=<config>        Configuration file (default: built-in xygeni.aisecurity.yml).
      --[no-]conf-download   Download scanner config? (default: true)
      --detectors=<list>     Comma-separated list of detector IDs to run (overrides config).
                             'all' for everything enabled.
      --skip-detectors=<list>
                             Comma-separated list of detector IDs to ignore.
      --owasp=<list>         Comma-separated list of OWASP LLM Top 10 categories to include
                             (LLM01..LLM10). Empty = all.
      --custom-detectors-dir=<customDetectorsDir>
                             Optional directory with custom-detector *.yml files.
```

By default, the command exits with a non-zero code when at least one AI Security finding is raised (useful for build gating). Use `--never-fail` to always return a success exit code regardless of the findings.

For the details of the scanner configuration file and the optional LLM semantic review stage, see [AI Security Scanner Configuration](/xygeni-products/ai-security/ai-security-scanner/ai-security-scanner-configuration.md). For the catalogue of detections, see [AI Security Detectors](/xygeni-products/ai-security/ai-security-detectors.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.xygeni.io/xygeni-products/ai-security/ai-security-scanner.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.