GenAI Finding Review

AMWScan can send selected finding context to an AI provider for a second, advisory opinion. The provider classifies the finding as malware, false_positive, or uncertain. AI review is disabled by default.

How review works

1. AMWScan detects findings using its normal signatures, function checks, exploit checks, and integrity checks.
2. After detection, it submits up to --ai-max-findings eligible findings.
3. Each request contains the matched rule, finding metadata, and a bounded excerpt around the detected line. The context size is controlled by --ai-context-lines.
4. The response is validated and attached to CLI output and structured reports with the verdict, confidence, provider status, model, and schema version.

Eligible findings include malware detections and informational keyword and encoded-function-candidate indicators. An encoded name may be used indirectly through variables, array keys, custom decoders, or file reads. The review asks for that context, but cannot establish a complete data flow from a bounded excerpt; missing context should produce an uncertain verdict.

AI results do not change finding status and never clean, delete, quarantine, whitelist, or modify files automatically. Even a malware verdict on an informational candidate does not promote it to a detection or change the CLI exit code. Treat verdicts as triage evidence, not as proof.

Choose a provider

Direct API providers

Use one of these providers and set its key in the environment:

Provider	Option	Environment variable
OpenAI	--ai-provider=openai	OPENAI_API_KEY
Anthropic	--ai-provider=anthropic	ANTHROPIC_API_KEY
Google Gemini	--ai-provider=gemini	GEMINI_API_KEY

AMWSCAN_AI_API_KEY is a provider-independent override. Do not pass keys as command arguments because shell history and process listings may expose them.

Installed CLI providers

AMWScan also supports claude-code-cli, codex-cli, copilot-cli, and opencode-cli. Use --ai-executable to select a non-default command and --ai-model to select a model.

CLI integrations run in an isolated temporary directory without a shell. They normally send the supplied source excerpt to a remote model service; an installed CLI does not imply local inference.

Review safely

Start with a report-only scan:

GEMINI_API_KEY=your-key php scanner /var/www/example \
  --report-only --report-format=json \
  --ai-provider=gemini --ai-context-lines=5 --ai-max-findings=20

Before enabling a provider, confirm that sending the selected code excerpts to that provider is acceptable for the project. Reduce --ai-context-lines and --ai-max-findings when handling sensitive or large scans. Review the original file, rule, surrounding code, and provider response together before taking action.

Use --ai-timeout to bound each request. A failed, unavailable, or invalid provider response is recorded as review failure and does not block ordinary detection.

WordPress

On WordPress 7.0 or newer, the plugin can use WordPress AI / configured connectors. This path uses connector credentials, model discovery, approval, and fallback policy managed by WordPress under Settings → Connectors. It does not store another API key in AMWScan. Direct API providers remain available as an advanced fallback.

See the CLI command reference for every option and default.