# dvalincode

Security scanner that verifies fixes independently of the agent and produces an offline-verifiable JSON proof.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 118
- Author: arthurpanhku
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/arthurpanhku/dvalincode
- Updated: 2026-10-19
- HTML: https://affpapa.org/en/nevibecode/mcp/dvalincode

## What it does

Dvalincode scans code for injection, XSS, hardcoded secrets, unsafe `eval` and shell calls. When an agent or human fixes a finding, the server re-scans on its own, runs the project's tests, and reads process exit codes. Who made the repair — Claude Code, Codex, Copilot, a person — is recorded but not consulted for the verdict.

The result is a `dvalin-fix-record/v3` file with fields: findings before and after, which checks passed, what new issues appeared. You can verify it on any machine without network using `dvalin verify-fix fix-record.json`. The server works with built-in rules (no API keys) and can plug in Semgrep, Snyk Code, Snyk OSS — the same engines your CI gate uses.

Full verification requires a git repository: when judging a fix, the server resets ignore files (`.snyk`, `.semgrepignore`) to the base commit state and blanks fresh suppression markers in code. If a finding was hidden with a new ignore rather than fixed, the record gets `regressed` status and fails verification.

## Requirements
- Needs: Node.js (commands run via npx)

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add dvalincode -- npx -y dvalincode
```

### Codex

**Platform CLI**
```bash
codex mcp add dvalincode -- npx -y dvalincode
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "dvalincode": {
            "command": "npx",
            "args": [
                "-y",
                "dvalincode"
            ]
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "dvalincode": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "dvalincode"
            ]
        }
    }
}
```

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add dvalincode npx -y dvalincode
```

## When to use it
- verify that an agent's fix actually removed the vulnerability
- run the same scanners that block merges in CI
- catch evasion: the fix added an ignore instead of a real repair
- get a verification record you can re-check offline without Dvalin

## Example prompts
- Scan the project for vulnerabilities using built-in rules and Snyk Code
- Check whether my fix passed verification for findings from the last scan
- Run a fix loop until clean results, using Semgrep and built-in rules

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2061
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1802

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md