PHP SDK Overview

Use the PHP SDK when your application needs to start a scan, consume its structured report, or query the built-in signature indexes. The supported API consists of AMWScan\Scanner and the read-only AMWScan\Signatures lookup methods.

Install and load

Install the package with Composer and load Composer's autoloader before using the SDK:

composer require marcocesarato/amwscan

require __DIR__ . '/vendor/autoload.php';

use AMWScan\Scanner;

The package requires PHP 7.4 or later with the fileinfo, json, mbstring, and zlib extensions. See Requirements for supported environments.

Choose an entry point

Need	API	Result
Scan files or a project	Scanner::run()	stdClass scan report or false on a caught scan error
Read a scan result after it completes	Scanner::getReport()	Current stdClass scan report
Check an exact SHA-256 malware hash	Signatures::findKnownMalwareHash()	Match record or null
Check a legacy normalized file hash	Signatures::matchesLegacyCoreFile()	bool
List built-in suspicious domain indicators	Signatures::getDomainIndicators()	Array of indicator records

Read Scan with Scanner before integrating scan execution. Read Reports and Findings before persisting or alerting on results.

Minimal unattended scan

use AMWScan\Scanner;

$scanner = new Scanner();
$report = $scanner
    ->enableLiteMode()
    ->setSilentMode()
    ->setAutoSkip()
    ->run([__DIR__ . '/project']);

if ($report === false) {
    throw new RuntimeException($scanner->getLastError() ?: 'Scan failed.');
}

printf("Scanned: %d; findings: %d\n", $report->scanned, $report->detected);

setSilentMode() configures non-interactive operation and selects skip as the default action unless you set another prompt. It does not make a scan read-only by itself. Keep automated remediation disabled until you have reviewed representative reports.

API stability

Scanner and the lookup methods documented in this section form the supported integration surface. Classes under Archive, Checkpoint, Console, Findings, Integrity, Modules, Remote, and Reputation support scanner internals. Do not couple an application to them or to public static properties such as Scanner::$settings and Signatures::$raw.

The scanner keeps configuration and reports in static state. One PHP process should execute one scan at a time. Use a separate process for concurrent jobs, queued scans, or isolation between tenants. Read Safety and State before running the SDK in a worker or long-lived web process.

Reference map

Reference	Contents
Scan with Scanner	Constructor, lifecycle, options, filters, output, and remediation controls
Reports and Findings	Report schema, coverage status, findings, diagnostics, and failure handling
Signature Lookup	Hash and domain lookup contracts
Safety and State	State lifetime, destructive actions, network behavior, and deployment guidance