CLI Command Reference
Run php scanner --help to see the options supported by your installed version.
php scanner [path] [options]
path accepts a file, directory, wildcard, or one FTP or FTPS URL. When omitted, the scanner uses the current directory.
Detection
| Option | Purpose |
|---|---|
--lite, -l | Reduce common false positives while retaining broad detection |
--only-signatures, -s | Scan for malware signatures only |
--only-exploits, -e | Scan for exploit patterns only |
--only-functions, -f | Scan for dangerous PHP functions only |
--exploits=<names> | Include selected exploit definitions, separated by commas |
--ignore-exploits=<names> | Exclude selected exploit definitions, separated by commas |
--functions=<names> | Scan for selected PHP functions, separated by commas |
--scan-all, --all | Inspect files regardless of extension |
--scan-archives | Inspect ZIP entries within safety limits |
--scan-wordpress-db | Run read only checks against a local WordPress database |
--disable-domain-analysis, --no-domain-analysis | Disable dangerous-domain analysis; scoped JavaScript definitions remain active |
--max-filesize=<size> | Skip files larger than the given size |
Scope and progress
| Option | Purpose |
|---|---|
--ignore-paths=<patterns> | Exclude comma separated paths or wildcards |
--filter-paths=<patterns> | Include only matching paths or wildcards |
--offset=<number> | Start at a position in the candidate file list |
--limit=<number> | Limit the number of mapped files |
--checkpoint=<path> | Save resumable scan progress in a private JSON file |
--resume | Continue a checkpoint when its files and settings still match |
--disable-cache, --no-cache | Ignore cached scan results |
php scanner /var/www/example --lite --report-only \
--ignore-paths="*/cache/*,*/logs/*" \
--max-filesize=5MB
GenAI finding review
GenAI review is disabled by default. When enabled, AMWScan asks the selected provider for an advisory malware, false_positive, or uncertain verdict after detection finishes. Each request contains the matched rule and a bounded code excerpt around the detected line. It never changes finding status or modifies files automatically. See GenAI Finding Review for provider setup, privacy considerations, and a safe review workflow.
| Option | Purpose | Default |
|---|---|---|
--ai-provider=<provider> | Use openai, anthropic, gemini, claude-code-cli, codex-cli, copilot-cli, or opencode-cli | disabled |
--ai-model=<model> | Override the provider or installed CLI model | Provider default |
--ai-context-lines=<number> | Include 0 to 20 lines above and below the detection | 5 |
--ai-max-findings=<number> | Limit review attempts per scan to 1 through 100 | 20 |
--ai-timeout=<seconds> | Limit each provider request to 5 through 300 seconds | 30 |
--ai-executable=<path> | Override the executable used by an installed CLI provider | Provider command |
API keys are read from OPENAI_API_KEY, ANTHROPIC_API_KEY, or GEMINI_API_KEY. AMWSCAN_AI_API_KEY overrides the provider-specific variable. Keys are not accepted as command options because command arguments can appear in shell history and process listings.
GEMINI_API_KEY=your-key php scanner /var/www/example \
--report-only --report-format=json --ai-provider=gemini
php scanner /var/www/example --report-only \
--ai-provider=claude-code-cli --ai-model=claude-sonnet-4-5
Direct API defaults are gpt-5.6-luna, claude-haiku-4-5, and gemini-3.8-flash. Installed CLI integrations invoke claude, codex, copilot, or opencode without a shell in an isolated directory. They normally send source excerpts to remote model services; installed does not mean local inference. Use --ai-executable when the command is installed under another name or path.
Reports and output
| Option | Purpose | Default |
|---|---|---|
--report | Write a report while retaining interactive actions | Off |
--report-only, -r | Disable interactive actions and write a report | Off |
--jobs=<count>, -j | Set parallel workers for eligible report-only scans (auto or 0 uses every detected CPU core; 1 disables parallelism) | Detected CPU cores, capped at 8 |
--report-format=<format> | Select html, txt, json, or sarif | html |
--path-report=<path> | Set the report file path | ./scanner-report.html |
--log=<path> | Write a scan log | Off |
--path-logs=<path> | Set the scanner log path | ./scanner.log |
--silent | Hide terminal output and prompts | Off in CLI |
--disable-report, --no-report | Prevent report generation | Off in CLI |
--disable-colors, --no-colors, --no-color | Remove ANSI colors | Off |
--debug | Display all PHP errors and warnings | Off |
See Scan reports for a screenshot, format guidance, coverage details, and report storage advice.
File actions
Use automated cleaning or deletion only with current backups and a tested recovery plan. Start with --report-only on each new project.
| Option | Purpose |
|---|---|
--backup, -b | Back up every file changed by the scanner |
--auto-clean | Remove matched code without confirmation |
--auto-clean-line | Remove the matched line without confirmation |
--auto-delete | Delete detected files without confirmation |
--auto-quarantine | Move detected files to quarantine |
--auto-skip | Leave every finding unchanged |
--auto-whitelist | Add every finding to the whitelist |
--auto-prompt=<action> | Apply one prompt response to every finding |
--whitelist-only-path | Match whitelist entries by path without line matching |
Store backups, quarantine, reports, and whitelist data outside the public document root:
| Option | Purpose |
|---|---|
--path-backups=<path> | Set the backup directory |
--path-quarantine=<path> | Set the quarantine directory |
--path-whitelist=<path> | Set the whitelist file (JSON by default; legacy CSV is supported) |
--findings-store=<path> | Set the canonical finding lifecycle JSON file |
--path-deobfuscate=<path> | Set the directory for deobfuscated files |
Whitelist paths are normalized and matched exactly relative to the scan root. JSON matching requires the same detection, line value, and stored match; a null line remains valid for file-level and hash findings. --whitelist-only-path skips the line comparison but still checks the exact path and detection, plus the stored match for JSON entries. Legacy CSV files do not store match content, and an empty third column represents a null line. Newly written CSV files include a version marker that distinguishes absolute paths from historical leading-separator relative paths.
Integrity and definitions
| Option | Purpose |
|---|---|
--disable-checksum, --no-checksum, --no-verify | Skip platform and package checksum verification |
--path-definitions=<path> | Set the private Maltrail definition cache |
--disable-definitions-update | Use the last verified Maltrail cache without an update request |
--defs | Print exploit and function definitions |
--defs-exploits | Print exploit definitions |
--defs-functions | Print dangerous function definitions |
--defs-functions-encoded | Print encoded function definitions |
Built in signatures remain available offline. Platform checksums and Maltrail definition updates can require outbound HTTPS on the first scan.
Utility options
| Option | Purpose |
|---|---|
--ftp-user=<username> | Set the FTP username, or use AMWSCAN_FTP_USER |
--update, -u | Update the standalone scanner file |
--version, -v | Print the installed version |
--help, -h, -? | Print command help |
FTP sources
Pass one ftp://host/path or ftps://host/path URL as the scan path. PHP needs the FTP extension, and FTPS needs ftp_ssl_connect.
Do not place credentials in the URL. Set the username with --ftp-user or AMWSCAN_FTP_USER. Set the password with AMWSCAN_FTP_PASSWORD. Prefer FTPS because FTP sends credentials and file contents without encryption.
AMWSCAN_FTP_USER=scanner \
AMWSCAN_FTP_PASSWORD=secret \
php scanner ftps://files.example.com/public_html --report-only
FTP scans use a temporary local mirror, force report mode, and remove the mirror after completion. One scan accepts one FTP source with limits of 10,000 files, 64 MiB per file, and 512 MiB total. FTP sources cannot use --scan-wordpress-db.
See FTP and FTPS integration for WordPress setup, server requirements, complete safety limits, and troubleshooting.
Platform checksum verification
Checksum verification supports WordPress, selected WordPress plugins, Drupal, Joomla, Magento Open Source, and public Composer packages. The scanner skips only files that match trusted release bytes. It scans modified, generated, and unknown files.
A first check for a platform version can require outbound HTTPS. Successful manifests remain in a local cache. Use --disable-checksum when the scan must make no checksum requests.
Coverage and resume
Reports separate discovered, eligible, scanned, cached, verified, and skipped files. Skip reasons include path filters, extensions, file size, unreadable files, and archive limits.
--checkpoint=<private-path> saves progress after each candidate. --resume continues only when the candidate list and scan settings still match.
ZIP scanning requires ext-zip. The scanner limits entry paths, symbolic links, entry count, file size, expanded size, compression ratio, and nesting depth. Reports mark content beyond those limits as incomplete coverage.
WordPress database scan
--scan-wordpress-db runs an optional read only phase against locally discovered WordPress installations. It checks database triggers, inventories primary site administrators, flags multiple administrators for review, and reports orphaned posts. It does not modify database content.
The option requires ext-mysqli. AMWScan reads literal database settings from wp-config.php without executing the file. Dynamic or ambiguous settings produce an incomplete coverage result.
Exit and automation guidance
Use JSON when another program will process detailed findings. Use SARIF for tools that understand the standard format. Keep reports as build artifacts, protect any local paths or code excerpts they contain, and test the scanner's exit behavior in your own continuous integration job before making it a release gate.