Analyzer IDs are the stable identities written to metadata.scanner_status. They describe evidence-producing execution, not vulnerability checks. Imported SARIF preserves its own provenance and is not reported as an analyzer Fendix executed.
Stable analyzer registry
| Analyzer ID | Family | Provenance | Status record | Contribution | Applies when |
|---|---|---|---|---|---|
| dast | DAST | native | Every non-import scan | Runs the registered HTTP observation checks against discovered endpoints. | A target URL is supplied and endpoint discovery succeeds. |
| spec | DAST | native | Every non-import scan | Loads an API specification for endpoint discovery and declared-route context. | A local or remote specification is supplied with --spec. |
| active-probes | DAST | native | Every non-import scan | Records the opt-in payload probes sent by active DAST checks. | Active testing is enabled and a discovered endpoint has probe-eligible parameters. |
| secrets | SAST | native | Every non-import scan | Scans source and configuration text for the bundled credential patterns and redacts secret material at capture time. | A code path is supplied and changed-file filtering does not exclude the pass. |
| textscan | SAST | native | Every non-import scan | Runs deterministic language and infrastructure text rules in process. | A code path contains a supported file type. |
| semgrep | SAST | hybrid | Every non-import scan | Runs the bundled Fendix Semgrep rule packs through the installed Semgrep executable. | A code path is supplied, --fast is not set, and the Semgrep dependency is available. |
| govulncheck | SCA | hybrid | Every non-import scan | Finds reachable Go advisories and preserves OSV provenance. | The code root has go.mod, native dependencies are enabled, and online lookup is available. |
| pip | SCA | native | Every non-import scan | Resolves pinned Python components against OSV or the configured offline snapshot. | A supported Python manifest is present under the code path. |
| npm | SCA | native | Every non-import scan | Resolves package-lock.json components against OSV or the configured offline snapshot. | A supported root package-lock.json is present. |
| python-engine | ORCHESTRATION | hybrid | Every non-import scan | Supervises the version-matched Python analyzer process and validates its protocol output. | Code or specification input requests the Python phase and the engine tree and interpreter are available. |
| python-engine/auth | SAST | external | When the Python protocol reports it | Reports the Python engine authentication-rule child outcome. | The Python protocol reports the auth child analyzer. |
| python-engine/injection | SAST | external | When the Python protocol reports it | Reports the Python engine injection-rule child outcome. | The Python protocol reports the injection child analyzer. |
| python-engine/deps | SCA | external | When the Python protocol reports it | Reports the Python dependency-tool child outcome separately from native pip/npm analyzers. | The Python protocol reports the deps child analyzer. |
| plugins | ORCHESTRATION | external | Every non-import scan | Runs configured third-party executables and preserves plugin-defined finding provenance. | At least one plugin executable is configured. |
Execution and controls
A target URL is supplied and endpoint discovery succeeds.
--url--max-duration--max-requests
A local or remote specification is supplied with --spec.
--spec
Active testing is enabled and a discovered endpoint has probe-eligible parameters.
--enable-active--max-probes-per-endpoint--max-requests
A code path is supplied and changed-file filtering does not exclude the pass.
--code--diff
A code path contains a supported file type.
--code--diff
A code path is supplied, --fast is not set, and the Semgrep dependency is available.
--code--fast--semgrep-timeout
The code root has go.mod, native dependencies are enabled, and online lookup is available.
--code--no-native-deps--offline
A supported Python manifest is present under the code path.
--code--offline--vulndb
A supported root package-lock.json is present.
--code--offline--vulndb
Code or specification input requests the Python phase and the engine tree and interpreter are available.
--python-engineFENDIX_ENGINE
The Python protocol reports the auth child analyzer.
--checks--python-engine
The Python protocol reports the injection child analyzer.
--checks--python-engine
The Python protocol reports the deps child analyzer.
--checks--python-engine--offline
At least one plugin executable is configured.
--plugins-dir
Coverage role
Every non-import scan emits the base analyzer entries once. The three python-engine/* children appear when the Python protocol reports them. A status says whether an evidence source delivered; it does not say whether that source found a vulnerability.