AI discovery scan

Most compliance starts with someone describing their AI system from memory. This starts with the code.

A dependency proves what your code could do, never what it ships. The OpenAI SDK covers text, images and speech in one package, so importing it does not mean you generate images. Everything below is a hypothesis for you to confirm or reject, not a finding. That distinction is the point: a scanner is a machine, and only a person can turn an observation into a compliance claim.

Paste a package.json, or a source fileWhichever you paste, it stays in this tab. A manifest gives possible capabilities; a source file with a real call site raises one to likely.

Nothing leaves this tab. The scan is a pure function running client-side, with no request to us. The CLI behaves the same way on your machine; the HTTP API is the only surface where you send us anything, and only what you choose to send.

Paste a manifest and press Scan.

Same engine, four entry points: this page, the CLI (`legalithm discover`), the HTTP API, and the MCP server. For features you already know about, use the Article 50 scope map.