[nightshift] idea-generator: improvement ideas for jarspect

[nightshift-micr]

Nightshift Idea Generator: Microck/jarspect

Project: Jarspect — AI-first security scanner for Minecraft .jar mods
Language: Rust (edition 2024), Axum web framework
Size: ~1,350 KB, ~30 source files
Analysis date: 2026-04-21

---

Summary

Jarspect is a well-architected 3-layer malware scanner (threat intel, bytecode extraction, AI verdict) with strong benchmarks (100% detection on 70 malware samples, 0 false positives on 50 benign mods). The codebase is clean and the documentation is exceptional. Below are improvement ideas ordered by impact and feasibility.

---

P2 — High-Value Feature Ideas

1. Batch/Directory Scanning API

Current state: Only single-file upload via POST /upload then POST /scan.
Idea: Add POST /scan-batch that accepts a directory path or ZIP of multiple .jar files, runs the pipeline in parallel, and returns a summary report. This is critical for server admins who need to scan entire mods/ folders at once.
Files: src/main.rs (new route), src/scan.rs (batch orchestrator), src/lib.rs (batch types).
Impact: High — most real-world usage involves scanning entire modpacks, not individual jars.

2. Scan Comparison/Diff Endpoint

Current state: Each scan produces an independent ScanRunResponse.
Idea: Add GET /scans/diff?scan_a=X&scan_b=Y that compares two scans (e.g., before and after a mod update) and highlights what changed: new capabilities, new YARA hits, verdict change.
Files: New src/diff.rs module.
Impact: Medium — useful for mod update verification and CI/CD integration for mod developers.

3. Scan History Dashboard (Web UI)

Current state: The web UI (web/) shows individual scan results but has no history view.
Idea: Add a scan history page that lists all past scans (read from .local-data/scans/), with filtering by verdict, date, and risk score. Include a trend chart showing scan verdicts over time.
Files: web/app.js, web/index.html, new GET /scans list endpoint in src/main.rs.
Impact: Medium — transforms Jarspect from a one-shot tool into an ongoing monitoring dashboard.

4. Rate Limiting and Scan Queue

Current state: No concurrency control — every POST /scan runs immediately, potentially overwhelming the AI API.
Idea: Add an in-memory scan queue with configurable concurrency limit. Return 202 Accepted with a status_url for long-running scans. Implement simple sliding-window rate limiting for the AI calls.
Files: src/main.rs (tower middleware), new src/queue.rs.
Impact: Medium — essential for production deployment where multiple users might scan simultaneously.

5. Webhook/Callback for Scan Completion

Current state: Synchronous scan — client must wait for the full pipeline (up to 30+ seconds with AI).
Idea: Add optional webhook URL in the scan request. When provided, return 202 Accepted immediately and POST the result to the callback URL when complete.
Files: src/main.rs (scan handler), src/scan.rs (async dispatch).
Impact: Medium — enables integration with CI/CD pipelines and external tools.

---

P3 — Architecture Improvements

6. Extract HTTP Layer into a Crate Feature

Current state: src/main.rs couples the Axum HTTP server with scan logic. The scanner core and the HTTP transport are in the same crate.
Idea: Make the HTTP server a feature flag (features = ["server"]). Allow using Jarspect as a library: jarspect::scan_file(path) -> ScanRunResponse.
Files: Cargo.toml (features), src/lib.rs (re-export public API).
Impact: Medium — enables CLI usage, embedding in other tools, and easier testing.

7. Structured Logging with Trace IDs

Current state: Logging uses tracing but scan operations don't carry a trace/correlation ID through the pipeline.
Idea: Add a scan_id-based tracing span that propagates through all layers (upload, MalwareBazaar, analysis, AI verdict). Makes debugging production issues much easier.
Files: src/scan.rs (span creation), all detector/analysis modules (span propagation).
Impact: Low-Medium — operational excellence for production deployments.

8. Configurable Detector Sensitivity Profiles

Current state: Detector severity thresholds are hardcoded. The AI handles context-aware assessment.
Idea: Add named sensitivity profiles (e.g., paranoid, balanced, relaxed) that adjust detector severity escalation gates. paranoid would flag more indicators at medium severity, useful for high-security environments.
Files: New src/profiles.rs or extend src/profile.rs, detector modules read thresholds from profile config.
Impact: Low-Medium — gives operators control without requiring AI reconfiguration.

9. Plugin System for Custom Detectors

Current state: 8 hardcoded capability detectors in src/detectors/.
Idea: Define a Detector trait and allow loading custom detectors from a directory (similar to how YARA rules are loaded). Researchers could add new detectors without modifying core code.
Files: src/detectors/spec.rs (trait definition), new src/detectors/registry.rs (dynamic loading).
Impact: Medium — enables community contributions and rapid response to new malware families.

10. Incremental YARA Rule Reloading

Current state: YARA rules are loaded once at startup (load_yara_rules).
Idea: Add POST /admin/reload-rules endpoint that hot-reloads YARA rules from disk without restarting the server. Useful for incident response when new signatures need to be deployed immediately.
Files: src/main.rs (new admin route), src/lib.rs (reload function with Arc<RwLock<>> swap).
Impact: Low — operational convenience for production deployments.

---

P3 — Quality-of-Life Improvements

11. CLI Subcommand (jarspect scan <file>)

Current state: HTTP-only interface. Running a scan requires curl or the web UI.
Idea: Add a scan subcommand that runs the pipeline on a local file and prints the result to stdout. Makes Jarspect usable in shell scripts and CI pipelines.
Files: src/main.rs (clap argument parsing), reuse run_scan.
Impact: Medium — dramatically lowers the barrier to entry for automation.

12. Docker/OCI Container Image

Current state: Only cargo run installation documented.
Idea: Add a multi-stage Dockerfile that builds a minimal static binary and packages it with the web UI and YARA rules. Publish to GitHub Container Registry.
Files: New Dockerfile, .github/workflows/publish.yml.
Impact: Medium — simplifies deployment and enables Kubernetes/cloud deployment.

13. Export Scan Results as PDF/HTML Report

Current state: Results are JSON only.
Idea: Add GET /scans/{id}/report?format=pdf|html that renders a formatted scan report suitable for compliance documentation or sharing with non-technical stakeholders.
Files: New src/report.rs module, template files in web/templates/.
Impact: Low — useful for organizations that need audit trails.

14. Health Check Should Include MalwareBazaar Connectivity

Current state: GET /health reports AI status and rule counts but doesn't verify MalwareBazaar API connectivity.
Idea: Add a lightweight connectivity check (e.g., HEAD request to MalwareBazaar API) to the health endpoint, with a timeout. Report malwarebazaar_reachable: true/false.
Files: src/main.rs (health handler).
Impact: Low — operational visibility.

15. YARA Rule Validation at Startup

Current state: YARA rules are compiled at startup, but compilation errors may produce unclear error messages.
Idea: Catch YARA compilation errors, print the specific rule name and error, and exit with a clear diagnostic. Optionally validate rules in CI.
Files: src/lib.rs (load_yara_rules error handling).
Impact: Low — developer experience.

---

Generated by Nightshift v3 — autonomous code quality bot.