What Is ScanDrix And How Does It Work?

ScanDrix is an autonomous AI-powered code review and AST security scanning platform built for modern engineering teams. It integrates into your Git providers (GitHub, GitLab, Bitbucket, Azure Repos) to automatically review pull requests, detect vulnerabilities, suggest code fixes, and enforce custom Drixy rules.

How Does ScanDrix Differ From Traditional Linters Like SonarQube?

Traditional linters analyze files in isolation using rigid regex or pattern rules, resulting in high false-positive rates and zero understanding of code intent. ScanDrix performs deep Abstract Syntax Tree (AST) analysis combined with multi-model AI reasoning, understanding whole-codebase context, taint flows, and architectural boundaries.

What Are Drixy Rules And How Do I Configure Them?

Drixy rules are customizable code review and security policies. You can define rules globally across your organization, per repository, or choose from a library of community best practices. You can also run 'Dry Run' previews to test rule modifications against real historical PRs before enforcing them.

Which Git Providers And CI/CD Tools Does ScanDrix Support?

ScanDrix supports GitHub, GitLab, Bitbucket, Azure Repos, and Forgejo out of the box. It also provides a CLI and team API keys for local developer workflows, pre-commit hooks, and custom CI/CD runners.

Does ScanDrix Train On Our Private Source Code?

No. ScanDrix never uses customer source code to train AI models. All code diffs are processed in ephemeral, isolated environments with strict zero-data-retention guarantees. For enterprise deployments, ScanDrix supports Bring Your Own Key (BYOK) and self-hosted on-premise installations.

How Fast Are ScanDrix Code Reviews On New Pull Requests?

ScanDrix is built for sub-minute reviews: an async worker architecture picks up webhook events without blocking CI pipelines. That is a design goal, not a measured guarantee — live service state is on the status page.

Can ScanDrix Suggest Inline Code Fixes?

Yes. When ScanDrix detects bugs, security vulnerabilities, or rule violations, it generates precise inline diff suggestions directly in the pull request review comments that developers can apply with a single click.

Can We Deploy ScanDrix On-Premise Or In Our Own VPC?

Yes. Enterprise customers can deploy ScanDrix in their own AWS, GCP, or Azure VPC, or in fully air-gapped on-premise environments with support for internal LLM endpoints (vLLM, Ollama) and enterprise SSO.

Five platforms · one review engine

Git integrations.

Connect the forge your team already uses. The same deterministic AST engine and Drixy rules run on every platform, with reviews designed for sub-minute turnaround.

Platforms: 5 supported
Setup time: Minutes
Languages: Multi-language AST
Review goal: Sub-minute

Supported platforms

Pick your forge.

No migration required. If it can send a pull request event, ScanDrix can review it.

GitHub

Install the GitHub App and grant repository access.

GitHub App install — no webhook URL to copy
Inline review comments with one-click commit buttons
Works with GitHub Enterprise Server
Organisation-wide or per-repository scope

Read the setup guide

GitLab

Add the webhook and a project access token.

Merge request review threads
Auto-resolve threads when a follow-up push fixes the finding
Self-managed and SaaS GitLab
Group-level or project-level scope

Read the setup guide

Bitbucket

Connect a workspace and grant repository permissions.

Pull request review with inline suggestions
Cloud and Data Center support
Workspace-level access control
No pipeline changes required

Read the setup guide

Azure Repos

Install the Azure DevOps app and pick an organisation.

Pull request reviewer integration
Azure DevOps Services and on-prem Server
Entra ID and personal access token auth
Policy-aware review comments

Read the setup guide

Forgejo

Beta

Add the webhook to your Forgejo instance.

Built for self-hosted forges
Same webhook contract as the GitHub app
Works alongside Gitea deployments
Public beta — tell us what breaks

Read the setup guide

Same engine everywhere

Platform-agnostic by design.

The integration layer only translates events. Everything that decides whether a finding is real lives in one place, so a rule behaves identically on GitHub and on a self-hosted Forgejo instance.

Event-driven, not polled

Reviews start from the platform's own push event, so there is no queue lag and nothing runs on a schedule. Ingestion is fire-and-forget with an outbox relay, so a webhook is never lost mid-flight.

Line-precise findings

Every finding lands on an exact file and line as a review comment with a severity, the violated rule, and a ready-to-commit patch — not a link out to a dashboard.

CLI and CI parity

The same engine runs in CI through the ScanDrix CLI, so a finding caught in a pipeline and a finding caught on a pull request are produced by identical analysis.

Minutes to first review

Connect your repositories.

Install the app, pick a repo, and read your first line-precise review.

Start free trial Read the docs