Scanner documentation

Submit a repository

Paste a GitHub repository URL, such as github.com/owner/repository. Leave the revision empty to use the repository’s default branch. Use Scan options to specify a branch, tag, commit SHA, or skill path.

A link to SKILL.md can also identify a skill. For branch names containing slashes, use the repository root URL and enter the complete branch name in Scan options to avoid ambiguous GitHub URLs.

Read and share the result

Keep the report link while the scan runs. The finished report includes coverage, correlated findings, optional AI intent, and expandable raw matches. Share the link or export the sanitized JSON. An incomplete scan has its own outcome even when some checks succeeded.

AI intent

AI analysis is optional and requires an AI-enabled scanner. The deterministic Nova and YARA checks work without an AI provider. If requested intent analysis cannot complete, that requirement is reported as incomplete.

Run the local worker

The website queues work; the worker executes it. From the standalone project directory, run these in separate terminals:

npm install
npm run dev -- --port 3100

npm run worker

The default worker uses Docker and the existing private crucible-github-agent-skills:local image. It uses GITHUB_TOKEN or your local GitHub CLI login for public repository access. See the project README for image configuration, AI credentials, Supabase storage, and deployment.

Use the API

Submit scans from a script or integration with the REST API. Download the OpenAPI specification for your API client. Automated hosted submissions use an operator-issued API key; report links remain unlisted.

Understand the scope