What Is ScanDrix And How Does It Work?

ScanDrix is an autonomous AI-powered code review and AST security scanning platform built for modern engineering teams. It integrates into your Git providers (GitHub, GitLab, Bitbucket, Azure Repos) to automatically review pull requests, detect vulnerabilities, suggest code fixes, and enforce custom Drixy rules.

How Does ScanDrix Differ From Traditional Linters Like SonarQube?

Traditional linters analyze files in isolation using rigid regex or pattern rules, resulting in high false-positive rates and zero understanding of code intent. ScanDrix performs deep Abstract Syntax Tree (AST) analysis combined with multi-model AI reasoning, understanding whole-codebase context, taint flows, and architectural boundaries.

What Are Drixy Rules And How Do I Configure Them?

Drixy rules are customizable code review and security policies. You can define rules globally across your organization, per repository, or choose from a library of community best practices. You can also run 'Dry Run' previews to test rule modifications against real historical PRs before enforcing them.

Which Git Providers And CI/CD Tools Does ScanDrix Support?

ScanDrix supports GitHub, GitLab, Bitbucket, Azure Repos, and Forgejo out of the box. It also provides a CLI and team API keys for local developer workflows, pre-commit hooks, and custom CI/CD runners.

Does ScanDrix Train On Our Private Source Code?

No. ScanDrix never uses customer source code to train AI models. All code diffs are processed in ephemeral, isolated environments with strict zero-data-retention guarantees. For enterprise deployments, ScanDrix supports Bring Your Own Key (BYOK) and self-hosted on-premise installations.

How Fast Are ScanDrix Code Reviews On New Pull Requests?

ScanDrix is built for sub-minute reviews: an async worker architecture picks up webhook events without blocking CI pipelines. That is a design goal, not a measured guarantee — live service state is on the status page.

Can ScanDrix Suggest Inline Code Fixes?

Yes. When ScanDrix detects bugs, security vulnerabilities, or rule violations, it generates precise inline diff suggestions directly in the pull request review comments that developers can apply with a single click.

Can We Deploy ScanDrix On-Premise Or In Our Own VPC?

Yes. Enterprise customers can deploy ScanDrix in their own AWS, GCP, or Azure VPC, or in fully air-gapped on-premise environments with support for internal LLM endpoints (vLLM, Ollama) and enterprise SSO.

Introduction

What ScanDrix is, how Drixy reviews pull requests, and where to go next.

ScanDrix is an autonomous AI code review and AST security scanning platform. It connects to your Git provider, reads every pull request, and returns inline review comments — vulnerabilities, rule violations, and one-click patch suggestions — typically in under 60 seconds.

Quickstart

Connect a repository and land your first automated review in a few minutes.

Review Flow

What happens between "PR opened" and "review posted", step by step.

Drixy Rules

Write organization-specific policies that Drixy enforces on every PR.

CLI

Run reviews locally with scandrix review --staged or inside any CI runner.

How it works

ScanDrix combines deterministic Abstract Syntax Tree analysis with multi-model AI reasoning. Diffs are parsed into ASTs, tainted flows and architectural boundaries are resolved, and review rules are evaluated against real code structure — not regex guesses over isolated files.

Webhook arrives. Your Git provider notifies ScanDrix that a pull request was opened or updated.
Diff is analyzed. The diff is expanded with surrounding context and parsed. Secrets are redacted before any model call.
Rules are evaluated. Active Drixy rules (organization, repository, or library) run against the AST with severity-based filtering.
Review is posted. Inline comments, patch suggestions, and a summary appear directly on the pull request.

Reviews are processed in ephemeral, isolated environments with zero data retention. ScanDrix never trains on customer source code.

What you get

Inline comments with severity, rule ID, and a concrete fix.
One-click patch suggestions as applyable diffs on the PR.
Custom Drixy rules — global, per-repository, or from a shared library, with Dry Run previews before enforcement.
CLI and team API keys for local runs, pre-commit hooks, and custom CI.
Supported providers: GitHub, GitLab, Bitbucket, Azure Repos, and Forgejo.

Where to go next

Knowledge Base

Troubleshooting and frequently asked questions.

Self-Hosted

Deploy ScanDrix inside your own VPC or on-prem.

Cookbook

Recipes for monorepos, compliance pipelines, and team onboarding.

NextQuickstart