Runtime Scans
Runtime scan methods, targets, relay options, and provider adapters.
Methods
| Method | Description |
|---|---|
runtimeScans.create(definition, options?) | Start the hosted workflow without a local runner |
runtimeScans.get(id, signal?) | Read scan state and report |
runtimeScans.list(options?) | List runtime scans |
runtimeScans.run(target, options?) | Create the scan, execute relay events, and return the report |
runtimeScans.cancel(id) | Cancel the hosted workflow |
Target contract
interface RuntimeScanTarget {
describe(): RuntimeTargetDefinition | Promise<RuntimeTargetDefinition>;
invoke(invocation: RuntimeTargetInvocation):
| RuntimeTargetResponse
| string
| Promise<RuntimeTargetResponse | string>;
reset?(sessionId: string): void | Promise<void>;
}Create a target with createRuntimeTarget(options) or preserve a typed target with defineRuntimeTarget(target).
Run options
interface RuntimeRunOptions extends WaitOptions<RuntimeScan> {
eventConcurrency?: number;
eventPollIntervalMs?: number;
workerStallTimeoutMs?: number;
onEvent?: (event: RuntimeScanEvent) => void | Promise<void>;
scan?: RuntimeScanOptions;
}eventConcurrency controls how many isolated target sessions the local runner may execute at once. It defaults to 8 and is capped at 16; events within one session remain ordered. workerStallTimeoutMs defaults to six minutes and cancels a run when the hosted workflow stops making progress.
interface RuntimeScanOptions {
workspaceId?: string;
scanMode?: "full" | "quick"; // defaults to full
targetModel?: string;
temperature?: number;
reasoningEffort?: "low" | "medium" | "high";
knowledgeProfile?: "baseline" | "production" | "research";
attackSurfaces?: AttackSurface[];
usePineconeKnowledge?: boolean;
maxAdaptiveCandidates?: number;
}full covers every attack surface and ignores attackSurfaces. It uses the production knowledge profile unless you pass research, always uses adaptive knowledge, and raises maxAdaptiveCandidates to at least 10. quick honors attackSurfaces, knowledgeProfile, usePineconeKnowledge, and maxAdaptiveCandidates, and skips the production probe catalog.
runtimeScans.run() resolves to { scan, report }, where report is an agent report. See reports for its fields, including boundaryAssurance.secretsInContext. get() and list() return scans with credential-shaped values in target and options scrubbed.
Provider adapters are exported from @zeroleaks/sdk/ai-sdk and @zeroleaks/sdk/openai.