Deep Scan

Inkog Deep is an advanced orchestrator-based security analysis that goes beyond the standard Core scan. It uses an AI orchestrator to perform deeper analysis with enriched context, producing an agent profile, compliance mapping, and a premium HTML report.

Deep scans require the Inkog Deep role on your account. You’ll receive a 403 error without it.

Usage


# Deep scan your agent code
inkog -deep .
 
# Deep scan with HTML report
inkog -deep -output html . > deep-report.html
 
# Deep scan with JSON output
inkog -deep -output json . > deep-results.json
 
# Deep scan with SARIF output
inkog -deep -output sarif . > deep-results.sarif

Core vs Deep

Feature	Core	Deep
Static analysis	Yes	Yes
Agent Profile (architecture, framework, trust boundaries)	—	Yes
Strengths (passing security checks)	—	Yes
Compliance Coverage (EU AI Act, NIST, OWASP mapping)	—	Yes
Methodology (how the analysis was performed)	—	Yes
Extended finding fields (proof, false positive rationale)	—	Yes
Premium HTML report	—	Yes

Output Format Differences

Deep scans produce richer output across all formats:

Text: Header shows “Inkog Deep” instead of “Inkog Core”, plus a Strengths section listing passing security checks
HTML: Completely different premium report with Agent Profile, Severity Overview, Clean Detections, Compliance Summary, and Methodology sections
JSON: Includes a deep_report object with agent_profile, clean_detections, compliance_summary, methodology, and severity_summary
SARIF: Standard SARIF structure with findings from the deep analysis

How It Works

The CLI uploads redacted code to POST /v1/scan/deep
The server returns a scanID
The CLI polls GET /v1/scan/deep/{scanID} every 5 seconds
The AI orchestrator analyzes the code with enriched context
Results are returned when analysis completes (up to 30 minute timeout)

Deep scans typically take around 10 minutes due to the AI orchestrator performing multi-pass analysis. This is significantly longer than Core scans.

When Deep cannot evaluate a rule

Each Deep rule is evaluated by the orchestrator’s model. If a rule cannot be evaluated (model unavailable, quota exhausted), it is reported as an analysis error rather than as a pass: the CLI prints a warning with the count and the upstream message, errored rules are excluded from Strengths, and a scan in which every rule errored is marked failed instead of clean. The Core findings from the same run are unaffected.

Combining with Other Options

All standard flags work with -deep:


# Deep scan with policy filtering
inkog -deep -policy low-noise .
 
# Deep scan with severity threshold
inkog -deep -severity high .
 
# Deep scan with verbose output
inkog -deep -verbose .