WorkScanner

Scan your work communication. Discover the AI agents your business actually needs.

WorkScanner reads your real work — email, Slack, calendar, meeting transcripts, screen activity — and tells you which AI agents to build, with evidence from your own data. No questionnaires, no guesswork: the pipeline finds the recurring work you actually do, then writes a full spec for the agent that could absorb it.

WorkScanner is open source (MIT), self-hostable, and free — there is no billing in this codebase. You bring your own infrastructure: a Supabase project, a Clerk app, and an LLM API key.

The 60-second version

1. Connect a source — Gmail, Slack, Outlook, Calendar, iCloud Mail, or just upload meeting transcripts (the zero-OAuth path).
2. Scan — a 12-step pipeline classifies, clusters, and analyzes your communication: what roles you play, what you promise people, what keeps recurring.
3. Get agents — each opportunity ships with a ready system prompt, skills, tools, boundaries, before/after flow, and the evidence (from your data) that justified it.
4. Export — Markdown skill files for Claude Code, LangChain JSON, CrewAI YAML.

Team mode scans multiple people and finds cross-person patterns: duplicate agents, pipeline chains, bottlenecks, silos.

Architecture

flowchart LR
    subgraph you["Your infrastructure"]
        app["app<br/>Next.js UI + APIs<br/>:3000"]
        worker["worker<br/>scan pipeline + queue<br/>+ internal cron<br/>:3001"]
    end
    subgraph vendors["Services you bring"]
        supabase[("Supabase<br/>Postgres + pgvector")]
        clerk["Clerk<br/>auth"]
        llm["LLM API<br/>OpenRouter or Anthropic"]
    end
    browser["browser"] --> app
    app -->|"enqueue scans"| worker
    app --> supabase
    worker --> supabase
    worker --> llm
    app --> clerk

Loading

Two containers (app + worker) run wherever you want — Docker Compose out of the box. Supabase and Clerk are the two required external services; the LLM key can point at OpenRouter or directly at Anthropic. v1 is self-hosted but not air-gapped: Clerk and the LLM API need outbound internet. See ROADMAP.md for where that's headed.

Quick start (self-hosting)

git clone https://github.com/liorwn/workscanner.git
cd workscanner
cp .env.example .env               # fill in your keys
npm install --legacy-peer-deps     # the flag is mandatory for this repo
node scripts/bootstrap-db.mjs      # one-command DB setup (idempotent)
docker compose up --build -d

The full runbook — prerequisites, every secret explained, OAuth connectors, scheduled jobs, troubleshooting — is docs/SELF_HOSTING.md.

Development setup

npm install --legacy-peer-deps
cp .env.example .env.local          # same keys as self-hosting
npx prisma generate
npm run dev                         # app on http://localhost:3000

The pipeline worker runs separately when you want real scans locally:

npx tsx worker/server.ts            # worker on :3001; set WORKER_URL=http://localhost:3001

Testing

npm run test:unit         # level 2 — unit tests (fast, no external services)
npm run test:security     # focused security regression suite
npm run test:smoke        # level 1 — API probes against a deployed instance
npm run test:integration  # level 3 — pipeline modules (needs a real DB)
npm run test:e2e          # level 4 — Playwright against a running app
npm run test:scan         # level 5 — full real scan (opt-in, costs LLM spend)

npm run build runs unit + integration tests, generates the Prisma client, and builds the app. CI runs build + unit tests on every PR with no secrets required.

Security

• OAuth tokens and IMAP passwords are AES-256-GCM encrypted at rest (BOTLER_KEY_ENCRYPTION_SECRET).
• Content encryption at rest (opt-in): set CONTENT_ENCRYPTION=1 + CONTENT_ENCRYPTION_KEY to envelope-encrypt ingested message bodies, subjects, chat text, transcripts, and generated samples so database access alone can't read them. Threat model and honest limitations: docs/CONTENT_ENCRYPTION.md.
• Report share links are token-gated, revocable, and expirable; report HTML is escaped with a strict CSP.
• Vulnerability reports: see SECURITY.md.

Data deletion

Your scan data is yours to destroy at any time — no support ticket needed:

• One scan — DELETE /api/scan/[id] (or the scan page): removes the scan and everything derived from it, including its share links.
• All scan data — DELETE /api/scan-data (Settings): same sweep across every scan; account and connections survive.
• Whole account — DELETE /api/account (Settings → danger zone): everything above plus connections, API keys, webhooks, and the sign-in identity; Google OAuth grants are revoked.

All deletes are hard deletes. The shared deletion core is coverage-tested against the Prisma schema, so a new scan-scoped table can't ship without being accounted for.

Contributing

Dev setup, test levels, and the project's iron laws (test-first, additive-only schema, RLS on new tables) live in CONTRIBUTING.md. The most contributor-friendly large projects are on the roadmap.

License

MIT — see LICENSE.