# agent-security-scanner-mcp

Inspects AI-generated code for security flaws, flags hallucinated dependencies, and audits external MCP servers before your coding assistant runs them.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 124
- Author: sinewaveai
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/sinewaveai/agent-security-scanner-mcp
- Updated: 2026-10-18
- HTML: https://affpapa.org/en/nevibecode/mcp/agent-security-scanner-mcp

## What it does

This tool runs automated security checks on projects and assigns an overall letter grade from A to F. It inspects diffs and source files to catch SQL injection, exposed secrets, and command execution risks before code merges. The scanner also evaluates shell commands and filesystem actions ahead of execution.

It protects against supply chain threats. When language models invent dependency names, the scanner flags them to prevent dependency squatting attacks. It also audits third-party MCP endpoints for prompt poisoning, spoofed tool labels, and environment credential leaks.

Node.js and `npx` must be available locally. Without this runtime, the scanner commands will fail to execute.

## Requirements
- Needs: Node.js (commands run via npx)

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add agent-security-scanner-mcp -- npx -y agent-security-scanner-mcp
```

### Codex

**Platform CLI**
```bash
codex mcp add agent-security-scanner-mcp -- npx -y agent-security-scanner-mcp
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "agent-security-scanner-mcp": {
            "command": "npx",
            "args": [
                "-y",
                "agent-security-scanner-mcp"
            ]
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "agent-security-scanner-mcp": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "agent-security-scanner-mcp"
            ]
        }
    }
}
```

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add agent-security-scanner-mcp npx -y agent-security-scanner-mcp
```

## When to use it
- detect vulnerabilities and secrets in AI-generated pull request diffs
- audit external MCP tools for prompt poisoning and tool spoofing
- verify imported package names against registries to stop typosquatting
- generate CycloneDX SBOM records and check known CVEs via OSV.dev

## Example prompts
- Run a security check on `./src/app.ts` before staging changes.
- Audit the MCP server located at `./tools/mcp-server` for unsafe instructions.
- Check `package.json` for hallucinated dependency names in the npm ecosystem.

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2061
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1802

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md