How codescan-ai/codescan works
CodeScanAI is a CLI security scanner. The primary workflow parses scan options, selects all files or changed files, analyzes each file with a structured AI agent, and prints findings; PR scans can also post review comments to GitHub. The V2 agent scanner is the documented current workflow, with separate legacy provider-based scanning still present in the tree. The sampled source supports the V2 wiring shown here; unsampled modules are represented only where README capabilities or paths support them.
Main entry points: agent_scanner.py Agent Scanner · runner_v2.py V2 Runner · file_extractor.py Changed Files · agent.py Agent Setup
Components 18
CLI
- Argument Parser
core/utils/argument_parser.py - V2 Runner
core/runner_v2.py - Console Findings
core/code_scanner/agent_scanner.py
File Selection
- Agent Scanner
core/code_scanner/agent_scanner.py - Directory Scan
core/code_scanner/agent_scanner.py - Changed Files
core/utils/file_extractor.py - Changed Lines
core/utils/file_extractor.py
AI Analysis
- Agent Setup
core/agent.py - Finding Schema
core/agent.py - Pydantic AI
- Legacy Scanner
core/code_scanner/code_scanner.py
Integrations
- PR Commenter
core/utils/github_integration.py - Legacy Providers
core/providers
Other components
- CLI User
- Local Git
- GitHub API
- AI Model Service
- PR Review Comments
Connections 21
- CLI User → V2 Runner: starts scan
- V2 Runner → Argument Parser: parses options
- V2 Runner → Agent Scanner: starts scan
- Agent Scanner → Directory Scan: walks directory
- Agent Scanner → Changed Files: requests changed files
- Agent Scanner → Changed Lines: requests changed lines
- Changed Files → Local Git: reads local diff
- Changed Lines → Local Git: reads local diff
- Changed Files → GitHub API: fetches PR files
- Changed Lines → GitHub API: fetches PR patches
- Agent Scanner → Agent Setup: configures agent
- Agent Setup → Finding Schema: sets output type
- Agent Setup → Pydantic AI: creates agent
- Agent Scanner → Pydantic AI: submits file content
- Pydantic AI → AI Model Service: requests analysis
- Pydantic AI → Agent Scanner: returns findings
- Agent Scanner → Console Findings: prints findings
- Agent Scanner → PR Commenter: posts findings
- PR Commenter → GitHub API: creates review comment
- GitHub API → PR Review Comments: publishes comments
- Legacy Scanner → Legacy Providers: uses provider