Inline
The default. The scanners run one after another inside the request, and the response is the finished scan. It is the simplest way to run Aegis and the one used in development.
How a scan runs
From a request to a closed-out scan.
A scan is one request that fans out to the scanners, normalizes what they return, and settles the findings. It can run inside the request or on a separate worker.
The steps
What happens when you start a scan
These are the same whether the scanners run inline or on a worker.
Request
A request names a registered repository and, optionally, a subset of scanners. Aegis refuses it if the directory is missing or a scanner name is unknown.
Run
Each scanner runs over the directory under its time limit and returns JSON.
Normalize
Each result becomes unified findings with a severity, location, remediation, and dedup hash.
Persist
New findings are inserted, repeats are touched, and fixed findings that came back reopen.
Close out
Open findings whose scanner completed and no longer saw them become fixed. The scan's summary is written and completion is announced.
Two modes
Inline by default, queued when you want it
Queued
Aegis publishes one request per scanner to a message bus and returns a running scan. A separate worker takes a request, runs that scanner, and posts the result to an internal endpoint. When every scanner has reported, the endpoint closes the scan out. The bus is in memory by default or NATS JetStream.
Live events
A scan reports as it goes
A scan announces when it starts, reports each scanner as that scanner finishes, with its status and finding count, and announces when it completes, with the summary. The events travel on an event bus, in memory by default or Valkey, and any client connected to Aegis's WebSocket endpoint receives them. Nothing in the web app consumes them yet.
The summary
What a finished scan tells you
Each scan keeps a per-scanner result with its status and duration, and a summary of how many findings were new, reopened, and fixed, how many it saw in total, and the totals by severity and by scanner. Read the per-scanner results first: they tell you which scanners actually reported.
Contact
Questions about this tool?
Write to Renkara Media Group and a person will answer.