What Is ScanDrix And How Does It Work?

ScanDrix is an autonomous AI-powered code review and AST security scanning platform built for modern engineering teams. It integrates into your Git providers (GitHub, GitLab, Bitbucket, Azure Repos) to automatically review pull requests, detect vulnerabilities, suggest code fixes, and enforce custom Drixy rules.

How Does ScanDrix Differ From Traditional Linters Like SonarQube?

Traditional linters analyze files in isolation using rigid regex or pattern rules, resulting in high false-positive rates and zero understanding of code intent. ScanDrix performs deep Abstract Syntax Tree (AST) analysis combined with multi-model AI reasoning, understanding whole-codebase context, taint flows, and architectural boundaries.

What Are Drixy Rules And How Do I Configure Them?

Drixy rules are customizable code review and security policies. You can define rules globally across your organization, per repository, or choose from a library of community best practices. You can also run 'Dry Run' previews to test rule modifications against real historical PRs before enforcing them.

Which Git Providers And CI/CD Tools Does ScanDrix Support?

ScanDrix supports GitHub, GitLab, Bitbucket, Azure Repos, and Forgejo out of the box. It also provides a CLI and team API keys for local developer workflows, pre-commit hooks, and custom CI/CD runners.

Does ScanDrix Train On Our Private Source Code?

No. ScanDrix never uses customer source code to train AI models. All code diffs are processed in ephemeral, isolated environments with strict zero-data-retention guarantees. For enterprise deployments, ScanDrix supports Bring Your Own Key (BYOK) and self-hosted on-premise installations.

How Fast Are ScanDrix Code Reviews On New Pull Requests?

ScanDrix is built for sub-minute reviews: an async worker architecture picks up webhook events without blocking CI pipelines. That is a design goal, not a measured guarantee — live service state is on the status page.

Can ScanDrix Suggest Inline Code Fixes?

Yes. When ScanDrix detects bugs, security vulnerabilities, or rule violations, it generates precise inline diff suggestions directly in the pull request review comments that developers can apply with a single click.

Can We Deploy ScanDrix On-Premise Or In Our Own VPC?

Yes. Enterprise customers can deploy ScanDrix in their own AWS, GCP, or Azure VPC, or in fully air-gapped on-premise environments with support for internal LLM endpoints (vLLM, Ollama) and enterprise SSO.

CLI & Team Keys

Install the ScanDrix CLI, authenticate with team API keys, and run reviews locally or in CI.

The ScanDrix CLI runs the same review engine locally, in pre-commit hooks, or inside any CI runner.

Install

bash

curl -fsSL https://scandrix.dev/install | bash

The installer places a scandrix binary on your PATH (macOS, Linux, WSL). Verify:

bash

scandrix --version

Team API keys

CLI and CI runs authenticate with team API keys generated in the dashboard under Settings → API Keys. Keys start with the scandrix_ prefix.

bash

# Export for the current shell
export SCANDRIX_TEAM_KEY=scandrix_live_8f3a9b...

Pass the key per request either way:

http

x-team-key: scandrix_live_8f3a9b...

http

Authorization: Bearer scandrix_live_8f3a9b...

Treat team keys like passwords. They live in CI secret stores and developer environment files only — never in source code, shell history committed to a repo, or client-side bundles. Rotate immediately from the dashboard if a key is exposed; old keys are revoked instantly.

Local reviews

Review the current staging area before you even commit:

bash

scandrix review --staged

Other useful invocations:

bash

# Review uncommitted changes against main
scandrix review --base main

# Run a single rule against the working tree
scandrix review --rule sec-001

# Validate repository configuration
scandrix config validate

Output is a terminal-friendly summary with file:line anchors; add --json for machine-readable findings.

CI usage

Run reviews in your pipeline with the same key. GitLab example:

yaml

stages:
  - review

scandrix_code_review:
  stage: review
  image: scandrix/cli:latest
  script:
    - scandrix review --ci --base $CI_MERGE_REQUEST_TARGET_BRANCH_NAME
  only:
    - merge_requests
  variables:
    SCANDRIX_TEAM_KEY: $SCANDRIX_TEAM_KEY

In --ci mode the CLI exits non-zero when findings at or above your blocking severity exist, so merge gates work with your existing required-checks setup.

Pre-commit hook

bash

scandrix install-hooks

This adds a hook that runs scandrix review --staged before each commit. Skippable per-commit with git commit --no-verify when you need to land a WIP.

Command overview

Command	Purpose
`scandrix review`	Review staged, branch, or PR changes
`scandrix rules list`	Print the rule catalog with IDs
`scandrix rules dry-run`	Preview rule changes against history
`scandrix config validate`	Lint `scandrix.yml`
`scandrix install-hooks`	Install git hooks
`scandrix auth login`	Interactive auth for local use (alternative to team key)

PreviousBusiness Logic Validation NextCLI Command Reference