Architecture

Hawk-i is a set of independent subsystems. The scan pipeline chains a few of them together; the rest are standalone subcommands.

Scan pipeline stages

• Repository intelligence - indexes and parses source with tree-sitter, handles remote clones and the deployed-address path.
• Static rule engine - runs auto-discovered rules and enriches findings with remediation templates.
• AI engine - renders a prompt template and calls the configured LLM through litellm (only with --ai).
• Exploit sandbox - runs attack scripts in Docker (only with --sandbox).
• Data layer - scores findings and renders the report.

Standalone subsystems

The Deep agent, verify, upgrade, prove, registry, monitoring, and export are standalone subcommands rather than pipeline stages. Each can be used on its own.

The finding model

A finding is a plain dictionary, not a rigid class. The de-facto schema is title, severity, file, line, and vulnerable_snippet, merged with explanation, impact, fix_snippet, and rule. This keeps the JSON output easy to consume and easy to extend.

State on disk

All persistent state lives under ~/.hawki/: the scanned registry, Deep agent memory, monitor state, and local metrics. Reports are written to ./hawki_reports/ in your working directory. Nothing is sent anywhere.