One small agent on your PC, one decision engine in the cloud. AISG orchestrates 23 open-source security sensors, runs every scan locally on your machine, and returns a professional report — without your code ever leaving your hands.
Your first scan, end to end — six steps, most of them one-time setup.
AISG is split into two halves on purpose — so that the part that touches your code stays with you.
A thin local agent that does all the heavy lifting. You install it once; it stays in your tray.
This part is a dumb scanner by design — no scoring, no decision logic inside.
The decision engine. It never runs a scanner and never sees your code — it turns raw results into decisions.
This is the brain — it never ships to your machine, so the analysis stays trustworthy.
YOUR CODE & KEYS STAY WITH YOU — ONLY FINDINGS (METADATA) REACH THE CLOUD
Setup happens once. After that, every scan is: create target → click scan → read report.
Create your account (email or Google) and pick the plan that fits your depth — from Community (free) to Enterprise (custom). Paid tiers are coming soon; no credit card required to start.
After your access is active, open the Dashboard → Worker tab and click Download worker package. You receive one small file:
aisg-worker-<timestamp>.zipThis is the only file you'll ever need to download from AISG. Extract it to a folder of your choice (e.g. C:\aisg-worker).
No Python install needed — a portable Python runtime is bundled inside the package. Core code scans (secrets, dependencies, SAST, IaC) run with no extra install; Docker is optional and only needed for URL scans, DAST and LLM scanning. Then run the installer once:
# Windows (double-click or run in a terminal): install.bat # macOS / Linux: chmod +x install.sh && ./install.sh
Then go back to Dashboard → Worker → Register Worker. The dashboard shows you two credentials:
worker_id: wkr_xxxxxxxx secret : xxxxxxxxxxxxxxxx ← shown ONCE — save it now
The secret is displayed a single time for security — store it somewhere safe (password manager).
From the folder where you extracted the package, enroll the worker with the credentials above, then keep it running while you scan:
# enroll once (use your own id / secret / AISG URL): python -m worker enroll --id <worker_id> --secret <secret> --api https://aisg.web.id # keep this open while scanning (polls for jobs automatically): python -m worker run
When you see the worker check in as ● ONLINE on your dashboard, you're ready to scan.
In the Dashboard, create a target — either a local folder on your PC (e.g. C:\projects\my-app) or a live URL of your deployed app — then click Scan.
The cloud queues the job and checks your quota (server-side, can't be cheated). Your worker picks it up within seconds and runs the sensor suite locally — live progress (percentage + per-sensor status) streams to your dashboard.
When the scan finishes, the cloud processes the raw findings (dedup → severity → risk score → narrative) and builds your report: risk score, findings detail with file:line, prioritized remediation plan with fix guidance, checklist coverage and audit evidence. Download it as a professional PDF straight from the dashboard. Kalau ingin melihat bentuk nyatanya lebih dulu: contoh report dari pemindaian nyata.
Two free, standard tools — nothing else. No account on a cloud provider, no CI server, no agent cluster.
Your source code and your API keys stay on your machine — always. The worker scans in-place and uploads only findings metadata (tool, rule, title, file:line, severity). URL scans also run from your PC, so the AISG cloud IP never contacts your target — and it never gets flagged by your WAF.
The ones people actually ask.
One file: the AISG worker package (aisg-worker-*.zip), available from Dashboard → Worker → Download. It contains the local scan agent — the same part that would otherwise have to be installed manually. That's the only download you'll ever need; everything else happens in the browser.
Yes. It's a thin wrapper that launches the well-known open-source sensors (multi-language SAST, secrets & dependency scanning, …) as isolated external processes — native binaries, or containers when Docker is used. It contains no business logic — no scoring, no decision-making — and it's open to your inspection. Every request it sends to the cloud is signed with your per-install secret.
A website cannot reach into your PC — browsers are sandboxed, and a cloud server has no access to your files. More importantly, sending your production code to a third party would defeat the purpose of a security product. Running the scan where your code lives is both the only reliable way and the most private one.
Not for code scans. Secrets, dependency, IaC and SAST sensors (gitleaks, grype, osv-scanner, checkov, semgrep, bandit) run as isolated native binaries — no Docker needed. Docker is required only for the deeper engines (CodeQL, Trivy, TruffleHog, Syft), for URL scans/DAST, and for LLM scanning. Docker Desktop is free and a one-time install.
Your job stays queued in the cloud. The moment your worker comes online, it polls and picks it up automatically. You can also see your worker's status (online/offline) on the Dashboard.
Only the findings: which sensor, which rule, the title, the file and line, and the severity — plus summary counts. Never the file contents, never your keys, never your prompts. The report you receive is built from that metadata.
Start free with Community — local scan, no card required.
Start Scanning