Repolode
Submit
Pantheon-Security

Pantheon-Security/medusa

AI-first security scanner for code and AI agent configs, with built-in rules for LLM apps, MCP servers, and secrets leaked in chat or shell history.

View on GitHubWebsite
Stars
1,015
Forks
155
Open issues
3
Last commit
3 months ago

What is it?

MEDUSA is a command-line security scanner written in Python. It runs a large set of built-in rules, covering AI/ML applications, LLM agents, MCP servers, RAG pipelines and traditional code, without requiring external tools to be installed. Optional external linters such as bandit or eslint are picked up automatically when present.

Beyond general SAST scanning, it targets AI-specific risks. The `medusa scan --git` command vets a remote repository before cloning, checking AI editor configuration files such as `.cursorrules`, `.claude/` hooks and permissions, and MCP configs for poisoned or over-privileged content. The `medusa secrets scan` command looks for API keys and tokens in AI assistant chat logs and shell histories, and its `purge` subcommand redacts them interactively with a byte-identical backup made first.

Results can be exported as JSON, HTML, Markdown, SARIF, JUnit or text. The tool also supports incremental scans with content-hash caching, configuration via a `.medusa.yml` file, and integration with Claude Code, Gemini CLI, Cursor, Copilot and OpenAI Codex through generated context files.

Key features

  • 01Scan any GitHub repo with `medusa scan --git` before cloning, including AI editor config files.
  • 02Find API keys and tokens in AI chat and shell histories, with interactive redaction and backups.
  • 03Built-in rules for prompt injection, MCP tool poisoning, RAG and agent security.
  • 04Native rules for Rust and PHP, plus optional wrappers around external linters.
  • 05Exports results as JSON, HTML, Markdown, SARIF, JUnit or text, and supports CI use with `--fail-on`.

Use cases

  • Vetting a third-party repository or Claude Code configuration before cloning or running it.
  • Checking a codebase for leaked credentials in shell history or AI assistant logs.
  • Adding a security gate to a CI pipeline that uses SARIF or JUnit output.
  • Auditing LLM applications and MCP servers for prompt injection and tool poisoning risks.

Quick start

  1. 1

    Install MEDUSA from PyPI

    pip install medusa-security
  2. 2

    Run your first scan on the current folder

    medusa scan .

Things to know

  • Licensed under AGPL-3.0, a copyleft license whose network-use terms may apply to modified hosted deployments.
  • Some optional external linters must be installed separately from their vendors' documentation.

In collections

Security scanners, audits & threat intel tools

Topics

#security#static-analysis#sast#ai-security#llm-security#agent-security#devsecops#secrets-detection#code-analysis#cve-detection

FAQ

What is medusa?
AI-first security scanner for code and AI agent configs, with built-in rules for LLM apps, MCP servers, and secrets leaked in chat or shell history. MEDUSA is a command-line security scanner written in Python. It runs a large set of built-in rules, covering AI/ML applications, LLM agents, MCP servers, RAG pipelines and traditional code, without requiring external tools to be installed. Optional external linters such as bandit or eslint are picked up automatically when present.
Is medusa free to use? What license does it have?
medusa is open source under the AGPL-3.0 license. Check the license terms before using it in commercial products.
Is medusa still maintained?
Updated within 6 months. The last commit to medusa was on Aug 10, 2026.
What can I use medusa for?
Vetting a third-party repository or Claude Code configuration before cloning or running it. Checking a codebase for leaked credentials in shell history or AI assistant logs. Adding a security gate to a CI pipeline that uses SARIF or JUnit output. Auditing LLM applications and MCP servers for prompt injection and tool poisoning risks.
How do I install medusa?
Install MEDUSA from PyPI: pip install medusa-security Run your first scan on the current folder: medusa scan .
Where can I get medusa?
The source code and installation instructions are on GitHub: https://github.com/Pantheon-Security/medusa

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects