Skip to content

Scanning pipeline

ai_guardian.scanners.pipeline.scan_content(text, *, config=None, cwd=None, filename='input', source_type='file_content', source_command=None, file_path=None, tool_name=None, hook_event=None, tool_identifier=None, latency_timer=None, content_overrides=None, scanner_kwargs=None, registry=None)

Run all enabled content scanners on text.

Config resolution per scanner
  • If config is provided, the scanner's section is extracted from it (e.g. config["prompt_injection"]).
  • If the section is missing or config is None, the scanner loads its own config from ai-guardian.json via the standard loaders.
  • Language auto-detection overlays are applied for scanners that have supports_language_overlay=True in their registry entry.

When hook_event is provided, the scanner registry filters scanners applicable to that event. Without it (SDK path), all content scanners are eligible, filtered by available inputs (file_path, etc.).

content_overrides maps ScannerName → alternative text for that scanner (e.g., annotation-suppressed content for secrets/PII).

scanner_kwargs maps ScannerName → dict of extra keyword arguments for that scanner (e.g., context, ignore_files for secrets).

Returns only ScanResult objects where a detection occurred, plus any error results (extra["scan_error"] set) so callers can apply fail-closed logic. Each scanner is wrapped in try/except for fail-open behaviour by default.