Architecture

The architecture separates where code is analysed from where results are managed. Analysis happens inside your environment, on machines you already control. Management, meaning visibility across repositories, triage, history and reporting, happens in the dashboard. The two are connected only by authenticated rule downloads in one direction and findings uploads in the other.

Flow

YOUR ENVIRONMENT                               MAGDOX
-----------------------------------            ------------------------------------
magdox login  ---- device sign-in -------->  identity, organisation, role
              <--- short-lived credential --
magdox scan
  1. check rules  <--- signed rule bundle ---  rules and data service
                  <--- vuln DB snapshot -----
  2. scan working tree locally
     (SAST, dependencies, secrets,
      configuration, SBOM, CBOM)
  3. write local report (./magdox-report/)
  4. upload findings payload  ------------>  findings API (validate, org-scope)
     (no source files)                        dashboard: runs, findings, decisions
magdox report <run> <--- report file ---------  report renderer
browser  ------------------------------------>  dashboard

Why this split

• Source code is intellectual property. Scanning in place means it is never copied to a third party.
• Security teams need one view across hundreds of repositories. A central dashboard gives that without collecting code.
• Uploading findings instead of repositories keeps payloads small, typically kilobytes per run.
• Rules and vulnerability data change daily. Fetching signed bundles keeps every scan current without reinstalling the CLI.

Rule bundles

Rules and vulnerability data are delivered as versioned bundles signed by MAGDOX. The CLI verifies the signature before use, caches the bundle locally, and refreshes it when a newer version is published. The rule bundle version is recorded on every run so a result can be reproduced.

Tenancy

Every run, finding, decision and report belongs to exactly one organisation. Authorisation is checked on every request, including uploads and downloads from the CLI.

Components and technology