Repolode
Submit
sinewaveai

sinewaveai/agent-security-scanner-mcp

Security scanner for AI coding agents that checks generated code, MCP servers, prompts, and AI-suggested packages for risks.

View on GitHubWebsite
Stars
123
Forks
12
Open issues
34
Last commit
20 days ago

What is it?

agent-security-scanner-mcp is a security scanner built for AI coding agents such as Claude Code, Cursor, Windsurf, and Cline. It runs as a CLI, an MCP server, or a GitHub Action, and produces an A-F grade for a project along with a list of findings.

The scanner covers several risk areas: vulnerable code produced by agents (SQL injection, XSS, command injection, secrets), MCP server issues such as tool description poisoning and tool name spoofing, prompt injection detection, and pre-execution checks for risky shell, file, and network actions. It also detects package hallucination by checking AI-suggested dependency names against registries including npm, PyPI, RubyGems, and crates.io.

The project also includes SBOM generation in CycloneDX format, CVE lookups through OSV.dev, and an optional LLM-based semantic review agent called cr-agent. Output defaults to a compact format designed to be read by agents without filling their context window.

Key features

  • 01Project-wide scan with an A-F security grade
  • 02MCP server audit for tool poisoning and spoofed tool names
  • 03Package hallucination check across seven package ecosystems
  • 04Prompt injection and jailbreak detection
  • 05CycloneDX SBOM generation and OSV.dev vulnerability lookup

Use cases

  • Scanning an agent-written pull request before merging it
  • Auditing an MCP server before connecting it to a coding agent
  • Catching dependencies that an AI assistant invented before installing them
  • Adding a security gate to CI through the provided GitHub workflow setup

Quick start

  1. 1

    Scan the current project for an A-F agent security grade

    npx agent-security-scanner-mcp scan-project . --verbosity compact
  2. 2

    Install the scanner into your AI coding client (example: Claude Code)

    npx agent-security-scanner-mcp init claude-code

Things to know

  • Rule-based scanning does not replace npm audit or other dependency vulnerability tools.
  • Semantic review via cr-agent requires an LLM provider of your choice.

In collections

MCP servers

Topics

#agent-security#mcp#llm-security#sast#supply-chain-security#prompt-injection#package-hallucination#vulnerability-scanner#ai-agent-security#ai-security

FAQ

What is agent-security-scanner-mcp?
Security scanner for AI coding agents that checks generated code, MCP servers, prompts, and AI-suggested packages for risks. agent-security-scanner-mcp is a security scanner built for AI coding agents such as Claude Code, Cursor, Windsurf, and Cline. It runs as a CLI, an MCP server, or a GitHub Action, and produces an A-F grade for a project along with a list of findings.
Is agent-security-scanner-mcp free to use? What license does it have?
agent-security-scanner-mcp is open source under the MIT license. Check the license terms before using it in commercial products.
Is agent-security-scanner-mcp still maintained?
Actively maintained. The last commit to agent-security-scanner-mcp was on Oct 18, 2026.
What can I use agent-security-scanner-mcp for?
Scanning an agent-written pull request before merging it Auditing an MCP server before connecting it to a coding agent Catching dependencies that an AI assistant invented before installing them Adding a security gate to CI through the provided GitHub workflow setup
How do I install agent-security-scanner-mcp?
Scan the current project for an A-F agent security grade: npx agent-security-scanner-mcp scan-project . --verbosity compact Install the scanner into your AI coding client (example: Claude Code): npx agent-security-scanner-mcp init claude-code
Where can I get agent-security-scanner-mcp?
The source code and installation instructions are on GitHub: https://github.com/sinewaveai/agent-security-scanner-mcp

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects