# SafeWeave

SafeWeave scans a project for code flaws, exposed secrets and risky dependencies through MCP. Use it in your editor to surface security findings and ask your agent to address them.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 5
- Author: nickfluxk
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/nickfluxk/safeweave
- Updated: 2026-10-19
- HTML: https://affpapa.org/en/nevibecode/mcp/safeweave

## What it does

SafeWeave brings security scans into an MCP-connected editor. It checks source code for issues such as SQL injection and XSS, searches for credentials, reviews package dependencies for known CVEs, and checks Terraform, Dockerfile and Kubernetes configuration. It also covers container images, dependency licenses and application security settings. Runtime API scanning is part of the Cloud plan.

The server fetches scanner binaries when needed, including gitleaks, trivy and opengrep. For SAST it uses an installed `semgrep` first; otherwise it downloads opengrep. Without a license key, the trial covers 10 scans with three scanners. A free account unlocks local scans with seven. A separate Claude Code skill can trigger scans before `git commit`, `git push` or PR creation, but it depends on SafeWeave MCP being configured.

## Requirements
- Needs: Node.js (commands run via npx)
- Remote server: `https://mcp.safeweave.dev/mcp`
- Environment variables: `SAFEWEAVE_LICENSE_KEY` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

1. **Platform CLI: remote server**
```bash
claude mcp add --transport http safeweave https://mcp.safeweave.dev/mcp
```

2. **Platform CLI**
```bash
claude mcp add --env SAFEWEAVE_LICENSE_KEY=<SAFEWEAVE_LICENSE_KEY> --transport stdio safeweave -- npx -y safeweave-mcp
```
Replace <…> with your own values

### Codex

1. **Platform CLI: remote server**
```bash
codex mcp add safeweave --url https://mcp.safeweave.dev/mcp
```

2. **Platform CLI**
```bash
codex mcp add safeweave --env SAFEWEAVE_LICENSE_KEY=<SAFEWEAVE_LICENSE_KEY> -- npx -y safeweave-mcp
```
Replace <…> with your own values

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "safeweave": {
            "url": "https://mcp.safeweave.dev/mcp"
        }
    }
}
```
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "safeweave": {
            "command": "npx",
            "args": [
                "-y",
                "safeweave-mcp"
            ],
            "env": {
                "SAFEWEAVE_LICENSE_KEY": "<SAFEWEAVE_LICENSE_KEY>"
            }
        }
    }
}
```
Replace <…> with your own values

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "safeweave": {
            "type": "http",
            "url": "https://mcp.safeweave.dev/mcp"
        }
    }
}
```
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "safeweave": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "safeweave-mcp"
            ],
            "env": {
                "SAFEWEAVE_LICENSE_KEY": "<SAFEWEAVE_LICENSE_KEY>"
            }
        }
    }
}
```
Replace <…> with your own values

### Gemini CLI

1. **Platform CLI: remote server**
```bash
gemini mcp add -t http safeweave https://mcp.safeweave.dev/mcp
```

2. **Platform CLI**
```bash
gemini mcp add -e SAFEWEAVE_LICENSE_KEY=<SAFEWEAVE_LICENSE_KEY> safeweave npx -y safeweave-mcp
```
Replace <…> with your own values

## When to use it
- spot SQL injection and XSS in source code
- find credentials left in project files
- check packages for known CVEs
- detect misconfigurations in Terraform and Docker files
- review container images and application security settings

## Example prompts
- Scan this project for security issues and suggest fixes.
- Check the project's dependencies for known CVEs.
- Look for credentials accidentally committed in the source files.

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 392262
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89609
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12110
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7718
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2066
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1816

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md