Architecture - AwareXone Docs

AXguard is a deterministic scanner (CLI + JSON rules + hunters) plus an agent layer (skills, slash commands, MCP) that drives those engines.

Components

Path	Responsibility
`cli/main.py`	Argparse UI for all shipped commands
`engines/scanner.py` / `source_scan.py` / `rules_loader.py`	Scan orchestration and rule application
`engines/audit.py`	A→Z audit + report writes
`engines/app_model/`	Application model / surface
`engines/dataflow/`	Taint paths
`engines/verify/`	Hunter → Judge
`engines/adversary/`	False Positive Adversary
`engines/evidence/`	Evidence & confidence
`engines/attack_graph/`	Attack paths
`engines/twin/` · `memory/` · investigation · predictive	Deeper analysis
`engines/github/`	Optional GitHub App adapter
`engines/mcp/`	MCP server
`engines/api/`	Local FastAPI service
`rules/`	Detection packs
`commands/` · `skills/`	Agent plugin surfaces

Scan data flow

Target path
  → load rules
  → walk files (skip .git, node_modules, venv, …)
  → match language-scoped patterns
  → findings (severity, file, line, fix, …)
  → scan (stdout) or audit (phases + reports)

Diagnostic pipeline (audit soft-runs)

app model → dataflow → hunters → Judge
                              → Adversary
                              → Evidence & confidence
                              → Attack graph

Stages are best-effort: a failed diagnostic is recorded and the audit continues so you still keep vulnerability reports.

Design constraints

Stdlib-first runtime for core scan (no account, no phone-home)
Rules stay data (JSON packs) for safe contribution
Agent layer never replaces the CLI — it calls it
HTML reports are read-only; high-risk actions stay stubbed / CLI-only

See also CLI · MCP · Overview.