GenAI Finding Review
AMWScan can send selected finding context to an AI provider for a second, advisory opinion. The provider classifies the finding as malware, false_positive, or uncertain. AI review is disabled by default.
How review works
- AMWScan detects findings using its normal signatures, function checks, exploit checks, and integrity checks.
- After detection, it submits up to
--ai-max-findingseligible findings. - Each request contains the matched rule, finding metadata, and a bounded excerpt around the detected line. The context size is controlled by
--ai-context-lines. - The response is validated and attached to CLI output and structured reports with the verdict, confidence, provider status, model, and schema version.
AI results do not change finding status and never clean, delete, quarantine, whitelist, or modify files automatically. Treat them as triage evidence, not as proof.
Choose a provider
Direct API providers
Use one of these providers and set its key in the environment:
| Provider | Option | Environment variable |
|---|---|---|
| OpenAI | --ai-provider=openai | OPENAI_API_KEY |
| Anthropic | --ai-provider=anthropic | ANTHROPIC_API_KEY |
| Google Gemini | --ai-provider=gemini | GEMINI_API_KEY |
AMWSCAN_AI_API_KEY is a provider-independent override. Do not pass keys as command arguments because shell history and process listings may expose them.
Installed CLI providers
AMWScan also supports claude-code-cli, codex-cli, copilot-cli, and opencode-cli. Use --ai-executable to select a non-default command and --ai-model to select a model.
CLI integrations run in an isolated temporary directory without a shell. They normally send the supplied source excerpt to a remote model service; an installed CLI does not imply local inference.
Review safely
Start with a report-only scan:
GEMINI_API_KEY=your-key php scanner /var/www/example \
--report-only --report-format=json \
--ai-provider=gemini --ai-context-lines=5 --ai-max-findings=20
Before enabling a provider, confirm that sending the selected code excerpts to that provider is acceptable for the project. Reduce --ai-context-lines and --ai-max-findings when handling sensitive or large scans. Review the original file, rule, surrounding code, and provider response together before taking action.
Use --ai-timeout to bound each request. A failed, unavailable, or invalid provider response is recorded as review failure and does not block ordinary detection.
WordPress
On WordPress 7.0 or newer, the plugin can use WordPress AI / configured connectors. This path uses connector credentials, model discovery, approval, and fallback policy managed by WordPress under Settings → Connectors. It does not store another API key in AMWScan. Direct API providers remain available as an advanced fallback.
See the CLI command reference for every option and default.