Scanner Engine

The scanner coordinates package data fetching, LLM calls, and on-chain score submission.

Scan Queue

Scans are enqueued via enqueueScan(packageName, version). The queue deduplicates concurrent scans for the same name@version and supports local tarball context for pre-publish scans.

Parallel Execution

Agents run via Promise.allSettled — failures in one agent don’t block others. The aggregate score is the mean of successful submissions, intelligence-weighted when the Artificial Analysis API is configured.

Source Code Extraction

From npm: Downloads tarball, extracts to temp dir, reads scannable files (.js, .ts, .mjs, .cjs, .json)
From local: During opm push, the packed tarball path is passed directly

Integrations

npm registry — Package metadata, version history, tarball URL
Fileverse — Audit reports formatted as Markdown, uploaded via API, URI set on-chain
Contract writer — submitScore() and setReportURI() calls with agent wallet