Version: v0.21

Scanner

AMWScan\Scanner maps a target, runs enabled analyses, and returns the current report. Pass the target as the first run() argument; use setters for other configuration that run() does not parse again.

Constructor and lifecycle

use AMWScan\Scanner;

$scanner = new Scanner();
$report = $scanner->run(['/srv/app']);

Member	Contract
`__construct(?callable $wordpressDatabaseFactory = null)`	Creates a scanner. Omit the factory unless your integration supplies the optional WordPress database scanner dependency.
`run(array $args = [])`	Resets the current report, applies CLI-style arguments, scans the requested target, and returns `stdClass`. Returns `false` when it catches an exception or the run is interrupted.
`isInterrupted()`	Returns whether the current or most recent run was interrupted.
`getLastError()`	Returns the caught error message from the most recent failed run.
`getReport()`	Returns the current report as `stdClass`; use it after a successful run.

The optional $args array accepts the same option names as the command-line scanner. Always pass the target as its first item. run() also reapplies its positional path plus --max-filesize, --offset, and --limit options, so pass those controls through $args. See CLI Reference for flag names and constraints.

Target and file selection

Method	Input	Effect
`setPathScan(string $path)`	Existing file or directory path	Sets the current normalized scan target. A positional argument passed to `run()` overrides it.
`setIgnorePaths(array $paths)`	Path patterns	Excludes matching paths.
`setFilterPaths(array $paths)`	Path patterns	Restricts scanning to matching paths.
`setExtensions(array $extensions)`	File extensions without the leading dot	Replaces the eligible extension list.
`setScanAll(bool $scanAll)`	Boolean	Includes files beyond the configured extension list.
`setMaxFilesize(int $size)`	Bytes	Sets the current limit. Pass `--max-filesize=<size>` to `run()` for a scan-specific limit.
`setOffset(int $offset)` / `setLimit(int $limit)`	Non-negative integer	Scans a mapped subset for controlled batch processing.

Validate every path supplied by a request or job payload before passing it to the SDK. A web-facing integration should resolve the path against an allowed project root and reject locations outside it.

Detection scope

Method	Effect
`enableLiteMode()` / `disableLiteMode()`	Selects the lighter exploit definition set.
`setOnlySignaturesMode()`	Enables signatures and disables function and exploit scans.
`setOnlyExploitsMode()`	Enables exploit scanning only.
`setOnlyFunctionsMode()`	Enables signature and function scans and disables exploit scanning.
`setFunctions(array $functions)`	Replaces the dangerous function definitions.
`setFunctionsEncoded(array $functions)`	Adds supplied encoded functions to the built-in dangerous functions.
`setExploits(array $exploits)`	Replaces exploit definitions.
`enableChecksum()` / `disableChecksum()`	Enables or disables platform integrity verification.
`enableDeobfuscateMode()` / `disableDeobfuscateMode()`	Enables or disables deobfuscation output. Enabling it also enables report writing.

The three setOnly...Mode() methods replace one another's detection scope. Call one of them at most once per run. For normal application scans, start with lite mode and report-only behavior, then tune based on reviewed findings.

Output and execution controls

Method	Effect
`setSilentMode(bool $enabled = true)`	Disables interactive prompts. When enabled without an existing prompt, sets automatic skip.
`setColors(bool $enabled = true)`	Enables or disables terminal colors.
`enableLogs()` / `disableLogs()`	Enables or disables scanner logging.
`setPathLogs(string $path)`	Sets the log file path.
`enableReport()` / `disableReport()`	Enables or disables writing a report file.
`setPathReport(string $path)`	Sets the report path template.
`setReportFormat(string $format)`	Selects `html`, `txt`, `text`, `log`, `logs`, `json`, `sarif`, or `htm`. Invalid values leave the previous format unchanged.
`enableCache()` / `disableCache()`	Enables or disables scan caching.

Set setSilentMode() and setAutoSkip() for unattended report scans. Use JSON or SARIF output when another process consumes the report, but treat the in-memory report contract as the integration source of truth.

Remediation controls

Method	Default automatic action
`setAutoSkip()`	Leave the finding unchanged.
`setAutoClean()`	Remove matched code from a file.
`setAutoCleanLine()`	Remove the matching line.
`setAutoQuarantine()`	Move the file to quarantine.
`setAutoDelete()`	Delete the file.
`setAutoWhitelist()`	Add the finding to the whitelist.
`enableBackups()` / `setPathBackups(string $path)`	Preserve a backup of files that the scanner changes.
`setPathQuarantine(string $path)`	Sets the quarantine directory.
`setPathWhitelist(string $path)`	Sets the whitelist file. JSON is the default; legacy CSV is supported.

danger

setAutoClean(), setAutoCleanLine(), setAutoQuarantine(), and setAutoDelete() modify files. Enable backups, write outside the scanned tree, and test the workflow against a copy of the project before using automated remediation in production.

A bounded batch scan

use AMWScan\Scanner;

$scanner = new Scanner();
$report = $scanner
    ->setIgnorePaths(['/srv/releases/current/var/cache'])
    ->setExtensions(['php', 'phtml', 'htaccess'])
    ->enableLiteMode()
    ->setSilentMode()
    ->setAutoSkip()
    ->run([
        '/srv/releases/current',
        '--max-filesize=2097152',
    ]);

if ($report === false) {
    throw new RuntimeException($scanner->getLastError() ?: 'Scan failed.');
}

Inspect $report->coverage on every batch. A successful return only confirms that the scan completed; it does not mean every discovered file was eligible or readable.

Constructor and lifecycle​

Target and file selection​

Detection scope​

Output and execution controls​

Remediation controls​

A bounded batch scan​