User Scanner
User Scanner 性能与成本：基准覆盖、透视和人工复核
测量并发、模块延迟、代理开销、cross-scan 广度、报告大小和分析时间。
你将学会
- Explain module, pivot, report, and MCP layers
- Run a bounded scan and interpret uncertainty
- Apply authorization, rate-limit, and data-retention controls
开始前需要
- Basic Git and command-line usage
- Comfort reading a project README
You can explain the project, run its documented first step, and decide what to verify before adopting it.
先看结论
- Benchmark complete bounded cases with local/owned fixtures.
- Report latency, coverage, blocks, bytes, proxy overhead, report size, and analyst review.
- Optimize accepted evidence quality and cost, not raw request count.
Measure a case, not just requests
用相同夹具固定模块、并发、代理和输出，记录冷/热运行、p50/p95、阻断、重试、字节、pivot 广度、报告和人工复核成本，优化每个被接受检查的质量。
Pin module set, fixture responses, concurrency, proxy mode, TLS adapter, Python version, package commit, and output format. Cold index refresh and warm scans answer different questions.
Separate latency and coverage
Record p50/p95 per module, queue depth, connection reuse, timeout/retry rate, proxy health, response bytes, CPU/memory, and report size. For cross-scan, measure breadth, depth, duplicate suppression, and critical-path time rather than only total requests.
Higher concurrency may improve throughput while increasing blocks, provider load, and review volume. Treat coverage and evidence quality as separate dimensions.
Price data and analyst time
Include proxy or API costs, storage, CI minutes, report review, false-positive verification, and deletion work. Calculate cost per accepted, defensible finding or exposure check—not per HTTP call.
A faster scan that collects too much or creates ambiguous pivots is not an optimization. Keep the same rubric and fixture when comparing a candidate change.
Publish a decision-ready report
Store raw timings, fixture hash, module snapshot, environment, redacted outputs, and reviewer notes. Set budgets for concurrency, request volume, storage, review minutes, and proxy spend; canary changes before broad use.
如何选择
| 比较维度 | 方案 A | 方案 B |
|---|---|---|
| Best when | You need predictable behavior and easy auditing | You need adaptive optimization and have reliable telemetry |
| Main risk | May leave performance on the table | Can become difficult to explain or debug |
实施步骤
- 1
Freeze fixture, modules, runtime, concurrency, proxy, and output.
- 2
Measure cold/warm, per-module, pivot, export, and failure paths.
- 3
Calculate resources, bytes, spend, review, and deletion cost.
- 4
Publish raw receipts, budgets, canary results, and rollback criteria.
可复制示例
fixture -> module p50/p95 + blocks/retries
-> bounded pivots -> report bytes/review minutes
-> cost per accepted exposure check常见问题
Is more concurrency always better?
No. It can increase blocks, provider load, false positives, and review volume; benchmark the complete case.
Should I publish live target timings?
Only with authorization and careful redaction; local mocks are preferred for reproducible articles.
资料来源
- User Scanner README (captured 2026-08-31)来源核查 2026-08-31
- User Scanner repository来源核查 2026-08-31