One small agent on your PC, one decision engine in the cloud. AISG orchestrates 23 open-source security sensors, runs every scan locally on your machine, and returns a professional report — without your code ever leaving your hands.
Your first scan, end to end — six steps, most of them one-time setup.
AISG is split into two halves on purpose — so that the part that touches your code stays with you.
A thin local agent that does all the heavy lifting. You install it once; it stays in your tray.
This part is a dumb scanner by design — no scoring, no decision logic inside.
The decision engine. It never runs a scanner and never sees your code — it turns raw results into decisions.
This is the brain — it never ships to your machine, so the analysis stays trustworthy.
YOUR CODE & KEYS STAY WITH YOU — ONLY FINDINGS (METADATA) REACH THE CLOUD
Setup happens once. After that, every scan is: create target → click scan → read report.
Create your account (email or Google) and claim the Free Test (7 days · 2 targets · 4 scan runs · Beginner-level sensors). No credit card required for the free slot.
After your access is active, open the Dashboard → Worker tab and click Download worker package. You receive one small file:
aisg-worker-<timestamp>.zipThis is the only file you'll ever need to download from AISG. Extract it to a folder of your choice (e.g. C:\aisg-worker).
No Python install needed — a portable Python runtime is bundled inside the package. Docker is required (sensors run as isolated containers). Then run the installer once:
# Windows (double-click or run in a terminal): install.bat # macOS / Linux: chmod +x install.sh && ./install.sh
Then go back to Dashboard → Worker → Register Worker. The dashboard shows you two credentials:
worker_id: wkr_xxxxxxxx secret : xxxxxxxxxxxxxxxx ← shown ONCE — save it now
The secret is displayed a single time for security — store it somewhere safe (password manager).
From the folder where you extracted the package, enroll the worker with the credentials above, then keep it running while you scan:
# enroll once (use your own id / secret / AISG URL): python -m worker enroll --id <worker_id> --secret <secret> --api https://aisg.web.id # keep this open while scanning (polls for jobs automatically): python -m worker run
When you see the worker check in as ● ONLINE on your dashboard, you're ready to scan.
In the Dashboard, create a target — either a local folder on your PC (e.g. C:\projects\my-app) or a live URL of your deployed app — then click Scan.
The cloud queues the job and checks your quota (server-side, can't be cheated). Your worker picks it up within seconds and runs the sensor suite locally — live progress (percentage + per-sensor status) streams to your dashboard.
When the scan finishes, the cloud processes the raw findings (dedup → severity → risk score → narrative) and builds your report: risk score, findings detail with file:line, prioritized remediation plan with fix guidance, checklist coverage and audit evidence. Download it as a professional PDF straight from the dashboard.
Two free, standard tools — nothing else. No account on a cloud provider, no CI server, no agent cluster.
Your source code and your API keys stay on your machine — always. The worker scans in-place and uploads only findings metadata (tool, rule, title, file:line, severity). URL scans also run from your PC, so the AISG cloud IP never contacts your target — and it never gets flagged by your WAF.
The ones people actually ask.
One file: the AISG worker package (aisg-worker-*.zip), available from Dashboard → Worker → Download. It contains the local scan agent — the same part that would otherwise have to be installed manually. That's the only download you'll ever need; everything else happens in the browser.
Yes. It's a thin wrapper that launches the well-known open-source sensors (multi-language SAST, secrets & dependency scanning, …) as isolated Docker containers. It contains no business logic — no scoring, no decision-making — and it's open to your inspection. Every request it sends to the cloud is signed with your per-install secret.
A website cannot reach into your PC — browsers are sandboxed, and a cloud server has no access to your files. More importantly, sending your production code to a third party would defeat the purpose of a security product. Running the scan where your code lives is both the only reliable way and the most private one.
For now, yes — sensors run as isolated containers so nothing touches your system beyond the worker itself. Docker Desktop is free and a one-time install. (Native binaries are on the roadmap for non-technical users.)
Your job stays queued in the cloud. The moment your worker comes online, it polls and picks it up automatically. You can also see your worker's status (online/offline) on the Dashboard.
Only the findings: which sensor, which rule, the title, the file and line, and the severity — plus summary counts. Never the file contents, never your keys, never your prompts. The report you receive is built from that metadata.
Claim the Free Test — 7 days, Beginner-level scan depth, full report. No card required.
Start Free Scan