How samartomar/aih-scan works
AIH Scanner is a Node.js evidence-producing library and CLI: callers select a detector and source closure, the runner executes analysis, and the package seals, attests, and optionally bundles or projects the resulting evidence. The README also documents detector registration, OCI execution, and a separate bounded baseline-vet/publication capability. Paths identify the owning modules; several subsystem links reflect documented capabilities because their implementation was not sampled.
Main entry points: run-detector-v1.ts Scan runner · engine-dispatch-v1.ts Engine dispatch · scan-attestation-v2.ts Scan attestation · batch-v1.ts Baseline vet records
Components 23
Entry and selection
- CLI
src/cli.ts - Detector capabilities
src/capability/detector-capability-v1.ts - Detector registration
src/registration/detector-registration-v1.ts
Detector execution
- Scan runner
src/runner/run-detector-v1.ts - Engine dispatch
src/runner/engine-dispatch-v1.ts - Bounded runtime
src/baseline/runtime-v1.ts - Cisco analyzers
src/detectors/cisco-multi-skill/index.ts - Cisco MCP scanner
src/detectors/cisco-mcp-scanner/index.ts - Snyk analyzer
src/detectors/snyk-agent-scan/index.ts
Evidence production
- Scan observation
src/observation/observation-evidence-v1.ts - Source seals
src/observation/source-seal-v2.ts - Scan attestation
src/observation/scan-attestation-v2.ts - Capture bundle
src/observation/scan-bundle-v2.ts - Findings projection
src/findings/scan-findings-v1.ts
Verification and projection
- Core evidence envelope
src/core/organization-evidence-envelope-v1.ts
Baseline evidence
- Baseline vet records
src/baseline/batch-v1.ts - Baseline signing and verification
src/baseline/attestation-v1.ts - Baseline publication
src/baseline/publication-v1.ts
Other components
- Caller
- Selected source
- Analyzer packages
tools/baseline-analyzers - Trust roots and policy
- Evidence consumer
Connections 24
- Caller → CLI: invokes
- Caller → Scan runner: requests scan
- Caller → Selected source: selects closure
- Scan runner → Detector capabilities: resolves detector
- Caller → Detector registration: supplies registration
- Scan runner → Engine dispatch: dispatches run
- Engine dispatch → Bounded runtime: runs engine
- Engine dispatch → Cisco analyzers: runs scan
- Engine dispatch → Cisco MCP scanner: runs scan
- Engine dispatch → Snyk analyzer: runs scan
- Bounded runtime → Analyzer packages: runs analyzer
- Engine dispatch → Analyzer packages: runs analyzer
- Scan runner → Selected source: reads source
- Scan runner → Scan observation: produces evidence
- Scan runner → Source seals: seals source
- Scan observation → Scan attestation: attests scan
- Scan attestation → Capture bundle: writes bundle
- Capture bundle → Evidence consumer: supplies evidence
- Scan attestation → Trust roots and policy: verifies against
- Scan attestation → Core evidence envelope: projects evidence
- Scan attestation → Findings projection: projects findings
- Evidence consumer → Baseline vet records: requests vet
- Baseline vet records → Baseline signing and verification: signs or verifies
- Baseline vet records → Baseline publication: packs records