DOCUMENTATION

MORPHEX Docs

Connect your Scanner workspace, collect redacted evidence, and understand the decisions behind each finding.

Quick Start

Use an API token from the operator of your Morphex Scanner. Choose Log in at the top of this site, enter the token, and open your workspace. Your token is checked against the backend before the portal opens.

RUNNING LOCALLY

Build from an authorized source checkout. The current Scanner is not distributed as a published package or prebuilt release. The public GitHub project provides project information; access to the production source is separate.

Start the Scanner

TERMINAL — FROM YOUR SOURCE CHECKOUT

make build
./morphex generate-key
./morphex serve --api-keys '<YOUR_API_TOKEN>'

Open the Website and Portal

SECOND TERMINAL — FROM THE SAME CHECKOUT

npm --prefix morphex-ui ci
npm --prefix morphex-ui run dev

Open http://localhost:3000 and choose Log in. Use the same token passed to the Scanner. The local website connects to the Scanner at http://localhost:8080 by default.

Run Your First Scan

CLI

./morphex scan --dry-run .
./morphex scan --json .
./morphex scan-git --json .
printf '%s' 'example source text' | ./morphex stdin --json

SOURCE SCOPE

File and directory scans operate on the backend machine. A path on your laptop is available only when your Scanner runs there or has access to that path. Use content input to scan pasted text.

How It Works

The Scanner extracts candidate values and evaluates source context. Its evidence capsule keeps classification, authentication observations, coverage, and policy decisions separate.

SELECT SOURCE SCOPE

EXTRACT CANDIDATES

CLASSIFY WITH CONTEXT

ASSESS REPORTING AND BLOCKING POLICY

RETAIN REDACTED EVIDENCE

REPLAY OR COMPARE

Suppressed observations remain available in the capsule. A missing finding does not establish that a credential was revoked. Coverage gaps remain visible rather than being treated as evidence of absence.

CLI Reference

Commands

FLAG	DESCRIPTION
morphex scan [options] <path>	Scan a file or directory
morphex scan-git [options] <repo>	Scan bounded Git history
morphex stdin [options] [filename]	Scan standard input; a filename enables language-specific analysis
morphex replay [options] <capsule>	Reassess retained evidence offline
morphex compare [--json] <before> <after>	Compare verified capsules by credential identity
morphex serve --api-keys KEY	Start the local Scanner API with durable scan history
morphex generate-key	Generate a token for the operator to configure

Scan Flags

Place flags before the path. Run morphex without arguments to see the complete command reference for your build.

FLAG	DESCRIPTION
--json	Complete redacted evidence capsule
--sarif	SARIF export with finding receipts
--threshold N	Reporting confidence from 0.3 to 1; default 0.7
--deep	Bounded decoding and archive inspection
--online	Explicit fixed-provider authentication checks
--verify	Check capsule, receipts, and session membership
--fail	Exit 1 for blocking decisions; exit 2 for incomplete scans or errors
--baseline PATH	Suppress exact reviewed occurrence fingerprints
--policy PATH	Source scope, exceptions, and initial policy
--workers N	0 to 32 file workers; 0 selects 4
--redact 100	Only full redaction is supported
--include GLOBS / --exclude GLOBS	Comma-separated source selection patterns

Configuration

Configure allowed source roots and durable storage when starting your Scanner. The website uses your configured backend; logging in does not start a Scanner process.

LOCAL SCANNER

./morphex serve --api-keys '<YOUR_API_TOKEN>' \
  --addr 127.0.0.1:8080 \
  --scan-roots /path/to/workspace \
  --data-dir /path/to/morphex-data

FLAG	DESCRIPTION
--scan-roots	Comma-separated allowed filesystem roots; defaults to the current directory
--data-dir	Exclusive local scan store; defaults to .morphex-data
--rate-limit	Requests per minute per API key; default 60

Use the policy and baseline controls when you need reviewed exceptions. A classification score and a blocking decision serve different purposes; review both in the evidence view.

CI/CD Integration

Build the Scanner in an authorized source checkout and run it against the selected workspace. Retain its evidence and exit status as CI artifacts.

SCAN COMMANDS

./morphex scan --json --fail /path/to/workspace > evidence.json
./morphex scan --sarif /path/to/workspace > findings.sarif

CI GATING

A blocking policy decision exits with code 1 when --fail is enabled. Incomplete scans and errors exit with code 2. Keep these outcomes distinct from a successful scan with no blocking decision.

Deep Scan Mode

The --deep flag enables bounded decoding and archive inspection. Local Go analysis also supports bounded constant composition and authentication-use evidence. This does not establish support for arbitrary expressions or every language.

TERMINAL

./morphex scan --deep --json /path/to/code

Check the capsule coverage when a source could not be processed. The animations on the home page are illustrations and are not a live evaluation of the sample code.

Evidence and Verification

Scanning is offline by default. --verify checks capsule consistency, receipts, and session membership. It does not contact a provider to establish whether a credential is active.

Explicit --online scanning can collect fixed-provider authentication observations. The portal preserves the observation returned by its backend. It never infers active status from a classification score.

INTEGRITY AND AUTHENTICATION

A classification receipt is a SHA-256 integrity record, not a digital signature or proof that a secret is valid. Replaying a capsule evaluates retained evidence without network access or rescanning source.

OFFLINE REVIEW

./morphex replay --check --json evidence.json
./morphex compare --json before.json after.json

Product Scope

This portal connects to the Go Scanner for scans, findings, history, evidence, and metrics. Some interface areas describe capabilities that are not connected to backend services; those areas remain clearly identified in the portal.

Node AI Cost Intelligence is a separate local library for costs, budgets, model routing, and attribution. It shares the repository with the Scanner but does not share its runtime.

Recovered enterprise source is not a current hosted service. Organization learning, fleet learning, and parts of the enterprise control plane remain incomplete.

PUBLIC PROJECT

Visit the public Morphex project →