CodeDelta — AI Agent Scan

Every text file is read. Each result says at which level.

A scanner that opens only the file types it knows best leaves the rest of the tree unexamined without saying so. Agent Scan reads every text file up to 2 MB and records on each result which of three levels it received, so a clean tree is a clean tree and not a silence.

Full rules — SDK tables, model calls, agent frameworks, loops, and the rogue rule — in C, C#, C++, Dart, Elixir, Go, Groovy, Java, JavaScript, Julia, Kotlin, Lua, Perl, PHP, PowerShell, Python, R, Ruby, Rust, Scala, Swift and TypeScript; also the script blocks of HTML, Vue, Svelte and Astro files and the code cells of Python notebooks.

Endpoint level — model endpoints, encoded payloads and the language's own launch and eval calls, with no SDK table — in shell scripts, CI recipes, Dockerfiles, Jenkinsfiles and Objective-C. The curl model | bash shape lives here and rates CRITICAL.

Text level — model endpoints and encoded payloads, plus Markdown code blocks that would rate HIGH or CRITICAL under their language's rules — for every other readable file, ELEVATED at most.

The user guide's language table carries the level per extension; that column is generated from the scanner's own tables, so the two cannot drift apart.

See the language table in the guide →

• FULL

  22 languages

  C, C#, C++, Dart, Elixir, Go, Groovy, Java, JavaScript, Julia, Kotlin, Lua, Perl, PHP, PowerShell, Python, R, Ruby, Rust, Scala, Swift, TypeScript.

• SCRIPT

  Web pages

  HTML, Vue, Svelte and Astro: the <script> blocks and inline event handlers scanned as JavaScript, findings attributed to the page and line.

• CELL

  Notebooks

  Jupyter code cells scanned as Python, including ! shell lines; each finding names the file line and the cell.

• ENDPOINT

  Shell, CI, containers

  Shell scripts, GitHub and GitLab workflows, Dockerfiles, Jenkinsfiles, Objective-C: endpoints, encoded payloads and launches.

• TEXT

  Everything else

  Any readable file to 2 MB: endpoints, encoded payloads, dangerous Markdown code blocks. ELEVATED at most.

• LABEL

  Stated on every file

  The report, the JSON and the CSV carry the coverage level per file; the summary line counts the files at each.

What a static scan can and cannot say.

Findings are patterns in source that warrant a human's look, not confirmed malicious activity; the report says so at the top of every run. The rogue rule works on proximity — a launch within ten lines of a model call — so a program that fetches a reply in one file and runs it from another is two ELEVATED files, not one CRITICAL.

Encoded literals are decoded once — base64 or hex, compressed or not — so a string encoded twice over is not read. A file that both serves a local model and pipes its output to a shell is treated as the server side and missed by the rogue rule. An agent CLI named as one element of an argument list is found only when its subcommand follows it directly.

Against careless concealment — the encoded prompt, the environment-variable host, the agent run from a CI step — this is a first tier that did not exist before. Against a determined adversary who builds every string at run time, no scan of the source is the last word, and this page does not claim to be.

• NORMAL

  No AI use found

  Nothing in the file matched an SDK, an endpoint or a launch rule at the level it was scanned.

• ELEVATED

  Uses AI, routine

  An SDK or endpoint is present. The ceiling for text-level files.

• HIGH

  Riskier use

  A model called inside a loop, an agent CLI launched with a prompt, prompts built from unchecked input.

• CRITICAL

  Runs what a model says

  The rogue pattern, an agent CLI with its checks bypassed, an encoded prompt or hidden host in a file that runs commands.