What Is ScanDrix And How Does It Work?

ScanDrix is an autonomous AI-powered code review and AST security scanning platform built for modern engineering teams. It integrates into your Git providers (GitHub, GitLab, Bitbucket, Azure Repos) to automatically review pull requests, detect vulnerabilities, suggest code fixes, and enforce custom Drixy rules.

How Does ScanDrix Differ From Traditional Linters Like SonarQube?

Traditional linters analyze files in isolation using rigid regex or pattern rules, resulting in high false-positive rates and zero understanding of code intent. ScanDrix performs deep Abstract Syntax Tree (AST) analysis combined with multi-model AI reasoning, understanding whole-codebase context, taint flows, and architectural boundaries.

What Are Drixy Rules And How Do I Configure Them?

Drixy rules are customizable code review and security policies. You can define rules globally across your organization, per repository, or choose from a library of community best practices. You can also run 'Dry Run' previews to test rule modifications against real historical PRs before enforcing them.

Which Git Providers And CI/CD Tools Does ScanDrix Support?

ScanDrix supports GitHub, GitLab, Bitbucket, Azure Repos, and Forgejo out of the box. It also provides a CLI and team API keys for local developer workflows, pre-commit hooks, and custom CI/CD runners.

Does ScanDrix Train On Our Private Source Code?

No. ScanDrix never uses customer source code to train AI models. All code diffs are processed in ephemeral, isolated environments with strict zero-data-retention guarantees. For enterprise deployments, ScanDrix supports Bring Your Own Key (BYOK) and self-hosted on-premise installations.

How Fast Are ScanDrix Code Reviews On New Pull Requests?

ScanDrix is built for sub-minute reviews: an async worker architecture picks up webhook events without blocking CI pipelines. That is a design goal, not a measured guarantee — live service state is on the status page.

Can ScanDrix Suggest Inline Code Fixes?

Yes. When ScanDrix detects bugs, security vulnerabilities, or rule violations, it generates precise inline diff suggestions directly in the pull request review comments that developers can apply with a single click.

Can We Deploy ScanDrix On-Premise Or In Our Own VPC?

Yes. Enterprise customers can deploy ScanDrix in their own AWS, GCP, or Azure VPC, or in fully air-gapped on-premise environments with support for internal LLM endpoints (vLLM, Ollama) and enterprise SSO.

How does ScanDrix differ from Greptile?

Greptile uses vector embeddings and RAG similarity search to retrieve repository context for an LLM prompt. ScanDrix parses real Abstract Syntax Trees (ASTs), compiles deterministic call graphs, and mathematically verifies taint paths before prompting, preventing hallucinated bugs and missed dependencies.

Why is AST analysis more reliable than vector search for code review?

Vector embeddings measure textual similarity, not execution logic. Two unrelated functions with similar naming can retrieve together, while a critical interface implementation in a differently-named file is omitted. AST parsing follows actual compiler import and call edges with 100% precision.

Does ScanDrix offer on-premise VPC deployment?

Yes. ScanDrix offers full on-premise VPC deployments with Bring Your Own Key (BYOK) model routing, ensuring private code never leaves your infrastructure.

ARCHITECTURAL COMPARISON

ScanDrix vs Greptile

Why compiler-level AST graphs outperform vector embeddings when reviewing mission-critical pull requests.

Capability	ScanDrix	Greptile
Context Retrieval Model	Deterministic compiler AST graph with full import & call edge traversal	Vector embeddings & RAG similarity search over chunked codebase text
Hallucination Prevention	Mathematical proof of taint path reachability before generating review	Probabilistic LLM reasoning without structural compiler verification
Custom Rules & Policies	Declarative Drixy rules with Dry Run testing against historical repository PRs	Natural language prompts without deterministic syntax matching
Cross-File Taint Tracking	Tracks untrusted user input from HTTP handlers to SQL/exec sinks across files	Textual similarity retrieval without symbolic dataflow tracking
Auditability & Traceability	Every finding links to exact syntax node, line numbers & AST rule ID	Black-box AI output based on similarity ranking
VPC & Self-Hosted Deployment	Air-gapped on AWS, Azure, GCP, or K8s with Bring-Your-Own-LLM routing	Hosted cloud SaaS relying on third-party vector databases

AST Graphs > Embeddings

Vector search checks text similarity. Compilers check real logic. ScanDrix parses real syntax trees so no cross-file import or interface is overlooked.

Deterministic Drixy Rules

Write rules in declarative YAML and test them on 100 historical PRs in Dry Run mode before enforcing them across your engineering team.

Verified Taint Reachability

ScanDrix mathematically verifies whether an untrusted parameter can reach an SQL or command sink before posting an alert, eliminating reviewer fatigue.

Architectural comparison from public product information — not measured runs, no scores. Something stale? Tell us via the contact page.

Eliminate Code Review Hallucinations

Switch from fuzzy similarity search to deterministic compiler-level code review today.

Start Free Trial