What Is ScanDrix And How Does It Work?

ScanDrix is an autonomous AI-powered code review and AST security scanning platform built for modern engineering teams. It integrates into your Git providers (GitHub, GitLab, Bitbucket, Azure Repos) to automatically review pull requests, detect vulnerabilities, suggest code fixes, and enforce custom Drixy rules.

How Does ScanDrix Differ From Traditional Linters Like SonarQube?

Traditional linters analyze files in isolation using rigid regex or pattern rules, resulting in high false-positive rates and zero understanding of code intent. ScanDrix performs deep Abstract Syntax Tree (AST) analysis combined with multi-model AI reasoning, understanding whole-codebase context, taint flows, and architectural boundaries.

What Are Drixy Rules And How Do I Configure Them?

Drixy rules are customizable code review and security policies. You can define rules globally across your organization, per repository, or choose from a library of community best practices. You can also run 'Dry Run' previews to test rule modifications against real historical PRs before enforcing them.

Which Git Providers And CI/CD Tools Does ScanDrix Support?

ScanDrix supports GitHub, GitLab, Bitbucket, Azure Repos, and Forgejo out of the box. It also provides a CLI and team API keys for local developer workflows, pre-commit hooks, and custom CI/CD runners.

Does ScanDrix Train On Our Private Source Code?

No. ScanDrix never uses customer source code to train AI models. All code diffs are processed in ephemeral, isolated environments with strict zero-data-retention guarantees. For enterprise deployments, ScanDrix supports Bring Your Own Key (BYOK) and self-hosted on-premise installations.

How Fast Are ScanDrix Code Reviews On New Pull Requests?

ScanDrix is built for sub-minute reviews: an async worker architecture picks up webhook events without blocking CI pipelines. That is a design goal, not a measured guarantee — live service state is on the status page.

Can ScanDrix Suggest Inline Code Fixes?

Yes. When ScanDrix detects bugs, security vulnerabilities, or rule violations, it generates precise inline diff suggestions directly in the pull request review comments that developers can apply with a single click.

Can We Deploy ScanDrix On-Premise Or In Our Own VPC?

Yes. Enterprise customers can deploy ScanDrix in their own AWS, GCP, or Azure VPC, or in fully air-gapped on-premise environments with support for internal LLM endpoints (vLLM, Ollama) and enterprise SSO.

Dry Run Testing

Preview and calibrate custom Drixy rules against historical pull requests before enforcing them across your engineering team.

When introducing a new security rule or style guideline, the biggest risk is false positive noise that frustrates developers and slows down release velocity.

ScanDrix includes a native Dry Run simulation engine that allows architects and security leads to test new rules against past pull requests before enabling them in production.

Why use Dry Run?

Zero Developer Friction: Test rules completely in the background without posting comments to live pull requests.
Accurate Hit Rates: Measure exactly how many historical PRs would have triggered the rule over the last 30, 60, or 90 days.
Noise Calibration: Inspect AST matches and adjust query selectors or threshold limits until false positives reach 0%.

Running a Dry Run from the Dashboard

Navigate to Rules Editor

In the ScanDrix dashboard, go to Rules → Create Rule or edit an existing custom rule.

Enter your AST Pattern or Policy

Define your rule's YAML definition and AST pattern matcher:

yaml

match:
  ast_call:
    - "jwt.Parse($TOKEN)"
  where:
    $TOKEN: "!calls(verifyKey)"

Select Simulation Scope

Click Run Simulation (Dry Run) and select the evaluation scope:

Select target repositories or choose all organization repos.
Set the lookback window (e.g. Last 50 Pull Requests).

Review the Impact Report

ScanDrix parses historical diffs against your AST matcher and produces an interactive impact matrix showing:

Total triggers across sample PRs.
Diff line snippets showing where the comment would have landed.
Estimated review delay and developer interaction metrics.

Promote to Production

Once satisfied that the rule only catches genuine violations, toggle the rule status from Draft / Dry Run to Active.

Running Dry Runs via the CLI

You can also run dry-run simulations locally in your terminal or inside CI pre-flight checks:

bash

# Test a new local rule file against the current branch diff
scandrix dryrun --rule ./rules/sec-auth.yaml --branch main

# Simulate rule against a specific remote pull request
scandrix dryrun --rule ./rules/sec-auth.yaml --pr 142

Previousscandrix.yml Reference NextBusiness Logic Validation