{
  "markdown": "<div align=\"center\">\n\n<img src=\"./prooflayer-logo.png\" alt=\"ProofLayer\" width=\"360\"/>\n\n# agent-security-scanner-mcp\n\n**Security scanner for AI coding agents, MCP servers, prompts, and AI-suggested packages.**\n\nRun it before Claude Code, Cursor, Windsurf, Cline, OpenCode, or another agent trusts new code, tools, prompts, or dependencies.\n\n[![npm downloads](https://img.shields.io/npm/dw/agent-security-scanner-mcp.svg)](https://www.npmjs.com/package/agent-security-scanner-mcp)\n[![npm version](https://img.shields.io/npm/v/agent-security-scanner-mcp.svg)](https://www.npmjs.com/package/agent-security-scanner-mcp)\n[![License: MIT](https://img.shields.io/badge/license-MIT-yellow.svg)](LICENSE)\n[![CI](https://github.com/sinewaveai/agent-security-scanner-mcp/actions/workflows/test.yml/badge.svg)](https://github.com/sinewaveai/agent-security-scanner-mcp/actions/workflows/test.yml)\n\n</div>\n\n## Copy-Paste Start\n\nScan any repo and get an A-F agent security grade:\n\n```bash\nnpx agent-security-scanner-mcp scan-project . --verbosity compact\n```\n\nInstall the scanner into your AI coding client:\n\n```bash\nnpx agent-security-scanner-mcp init claude-code\n```\n\nReplace `claude-code` with `cursor`, `claude-desktop`, `windsurf`, `cline`, `kilo-code`, `opencode`, or `cody`.\n\nAudit an MCP server before adding it to an agent:\n\n```bash\nnpx agent-security-scanner-mcp scan-mcp ./path/to/mcp-server --verbosity compact\n```\n\nCheck AI-generated imports for package hallucinations:\n\n```bash\nnpx agent-security-scanner-mcp scan-packages ./src/app.ts npm --verbosity compact\n```\n\n## What It Catches\n\n| Risk | Why agents need it | Command |\n| --- | --- | --- |\n| Vulnerable generated code | Agents can introduce SQL injection, XSS, command injection, unsafe crypto, and secrets | `scan-project`, `scan-security`, `scan-diff` |\n| MCP server attacks | MCP tools can poison descriptions, spoof names, exfiltrate env vars, or execute commands | `scan-mcp` |\n| Prompt injection | Agents often process untrusted docs, tickets, pages, and tool output | `scan-prompt` |\n| Unsafe agent actions | Catch dangerous shell/file/network actions before execution | `scan-action` |\n| Hallucinated packages | AI often invents dependency names that attackers can later squat | `check-package`, `scan-packages` |\n| SBOM and CVEs | Generate CycloneDX SBOMs and scan dependencies with OSV.dev | `sbom-generate`, `sbom-vulnerabilities` |\n| Semantic review | LLM-powered review that uses project intent to find context-aware issues | `cr-agent` |\n\n## Screenshots\n\n### Project Scan\n\n![Project scan demo](./images/readme-project-scan.svg)\n\n### MCP Server Audit\n\n![MCP audit demo](./images/readme-mcp-audit.svg)\n\n### Package Hallucination Detection\n\n![Package hallucination demo](./images/readme-package-check.svg)\n\n## Demos\n\nRun a safe local demo that creates intentionally vulnerable fixtures, scans them, and cleans them up.\n\n```bash\n# MCP audit demo: tool poisoning, spoofed tool name, command execution, secret exposure\nnpx agent-security-scanner-mcp demo --type mcp --no-prompt\n\n# Package hallucination demo: real imports mixed with fake AI-generated package names\nnpx agent-security-scanner-mcp demo --type packages --no-prompt\n```\n\nExpected demo shape:\n\n```json\n{\n  \"grade\": \"F\",\n  \"findings_count\": 8,\n  \"findings\": [\n    {\n      \"rule\": \"mcp.description-injection\",\n      \"severity\": \"ERROR\",\n      \"message\": \"Tool description contains imperative language directed at the LLM.\"\n    },\n    {\n      \"rule\": \"mcp.tool-name-spoofing\",\n      \"severity\": \"ERROR\",\n      \"message\": \"Tool name is close to a well-known MCP tool name.\"\n    }\n  ]\n}\n```\n\n## Install In Your Agent\n\n```bash\nnpx agent-security-scanner-mcp init claude-code\n```\n\n| Client | Setup |\n| --- | --- |\n| Claude Code | `npx agent-security-scanner-mcp init claude-code` |\n| Cursor | `npx agent-security-scanner-mcp init cursor` |\n| Claude Desktop | `npx agent-security-scanner-mcp init claude-desktop` |\n| Windsurf | `npx agent-security-scanner-mcp init windsurf` |\n| Cline | `npx agent-security-scanner-mcp init cline` |\n| Kilo Code | `npx agent-security-scanner-mcp init kilo-code` |\n| OpenCode | `npx agent-security-scanner-mcp init opencode` |\n| Cody | `npx agent-security-scanner-mcp init cody` |\n| Interactive picker | `npx agent-security-scanner-mcp init` |\n\nThen restart the client. Your agent can call the scanner as an MCP tool.\n\n## Agent Playbook\n\nPaste this into an agent task when you want it to work safely:\n\n```text\nBefore trusting new code, dependencies, prompts, or MCP tools, run:\n\n1. npx agent-security-scanner-mcp scan-project . --verbosity compact\n2. npx agent-security-scanner-mcp scan-packages ./src/app.ts npm --verbosity compact when imports change\n3. npx agent-security-scanner-mcp scan-mcp ./path/to/mcp-server --verbosity compact before adding MCP servers\n4. npx agent-security-scanner-mcp scan-diff --base main --target HEAD before opening a PR\n\nFix high-confidence security findings before continuing.\n```\n\n## Common Workflows\n\n### Before You Trust An Agent-Written PR\n\n```bash\nnpx agent-security-scanner-mcp scan-diff --base main --target HEAD --verbosity compact\nnpx agent-security-scanner-mcp scan-packages ./src/app.ts npm --verbosity compact\n```\n\n### Before Installing An MCP Server\n\n```bash\nnpx agent-security-scanner-mcp scan-mcp ./path/to/mcp-server --verbosity compact\n```\n\n### Before Adding A Dependency Suggested By AI\n\n```bash\nnpx agent-security-scanner-mcp check-package express npm\nnpx agent-security-scanner-mcp scan-packages ./package.json npm --verbosity compact\n```\n\n### Add CI\n\n```bash\nnpx agent-security-scanner-mcp init-ci github\n```\n\n### Generate Share Copy From A Real Scan\n\n```bash\nnpx agent-security-scanner-mcp scan-project . --verbosity compact > scan-result.json\nnpx agent-security-scanner-mcp share-kit --scan-result scan-result.json --output share-kit.md\n```\n\n## CLI Reference\n\n| Command | Use |\n| --- | --- |\n| `scan-project <dir>` | Full project scan with A-F grade |\n| `scan-security <file>` | Single-file security scan |\n| `scan-diff --base main --target HEAD` | Scan changed files only |\n| `scan-mcp <path>` | Audit an MCP server before install |\n| `scan-prompt \"<text>\"` | Detect prompt injection and jailbreak attempts |\n| `scan-action <type> <value>` | Pre-execution safety check for shell/file/network actions |\n| `check-package <name> <ecosystem>` | Verify one package exists |\n| `scan-packages <file> <ecosystem>` | Verify imports/dependencies in a file |\n| `doctor` | Check local setup health |\n| `quickstart --client cursor` | Generate repo-specific next steps |\n| `share-kit` | Generate public-safe launch/share copy |\n| `export-vanta` | Export scan evidence to the ProofLayer Vanta integration |\n\nAll scanner outputs support context-friendly verbosity:\n\n```bash\n--verbosity minimal   # counts only, best for CI\n--verbosity compact   # default, best for agents and humans\n--verbosity full      # audit/debug detail\n```\n\n## MCP Tools For Agents\n\nWhen installed as an MCP server, agents get these tool families:\n\n| Tool family | Purpose |\n| --- | --- |\n| `scan_security`, `fix_security`, `scan_git_diff`, `scan_project` | Code and repo security |\n| `scan_mcp_server`, `scan_skill` | MCP and AI skill security |\n| `scan_agent_prompt`, `scan_agent_action` | Prompt/action safety |\n| `check_package`, `scan_packages` | Package hallucination detection |\n| `sbom_generate`, `sbom_scan_vulnerabilities`, `sbom_diff`, `sbom_export_report` | Supply-chain and release evidence |\n| `get_compliance_controls`, `evaluate_compliance` | SOC2/GDPR/AIUC-1 technical evidence |\n| `scanner_health` | Runtime diagnostics |\n\n## Why Developers Install It\n\n- One `npx` command gives an A-F security grade for AI-written code.\n- MCP-specific checks catch risks that normal SAST tools miss.\n- Package hallucination detection checks 4.3M+ package names across npm, PyPI, RubyGems, crates.io, pub.dev, CPAN, and raku.land.\n- Output is compact by default so coding agents can read it without burning the context window.\n- Works as a CLI, MCP server, GitHub Action workflow, Apify Actor, and semantic review agent.\n- MIT licensed.\n\n## Semantic Code Review\n\n`cr-agent` is bundled with the npm package for LLM-powered semantic review. It reads project intent, then looks for code that violates that intent.\n\n```bash\nnpx cr-agent analyze ./path/to/project -p claude-cli --verbose\nnpx cr-agent analyze ./path/to/project -p openai --format sarif\n```\n\nUse it when rule-based scanning is not enough and the question is, \"Does this code make sense for what this project is supposed to do?\"\n\n## SBOM And Compliance Evidence\n\n```bash\nnpx agent-security-scanner-mcp sbom-generate .\nnpx agent-security-scanner-mcp sbom-vulnerabilities .\nnpx agent-security-scanner-mcp sbom-check-hallucinations .\nnpx agent-security-scanner-mcp evaluate-compliance . --framework soc2-technical\n```\n\nUseful before releases, SOC 2 evidence collection, vendor reviews, and AI-generated dependency changes.\n\n## Apify Actor\n\nRun the scanner as an Apify Actor when you want a hosted API or scheduled scans:\n\n```json\n{\n  \"actorId\": \"folkloric_morale/agent-security-scanner\",\n  \"input\": {\n    \"target\": \"repository\",\n    \"repoUrl\": \"https://github.com/your-org/your-agent.git\",\n    \"repositoryScanMode\": \"quick\",\n    \"includeTestFiles\": false,\n    \"maxRepositoryFiles\": 150,\n    \"severityThreshold\": \"medium\"\n  }\n}\n```\n\n## Latest Release\n\n`v4.5.8` adds diff-scoped `cr-agent` semantic review, fixes nested repository diff lookups, and filters semantic findings to changed hunks so PR reviews stay focused on code that actually changed.\n\nDetailed release history lives in [CHANGELOG.md](./CHANGELOG.md). The older README-embedded changelog is archived at [archive/README_CHANGELOG_ARCHIVE.md](./archive/README_CHANGELOG_ARCHIVE.md).\n\n## FAQ\n\n**Is this only for MCP servers?**\nNo. It scans normal repos, diffs, prompts, actions, packages, SBOMs, MCP servers, and AI skills.\n\n**Does it send my source code anywhere?**\nRule-based CLI and MCP scans are local. `cr-agent` uses the provider you choose for semantic review.\n\n**Is it a replacement for npm audit?**\nNo. It complements npm audit by catching AI-specific risks: hallucinated packages, prompt injection, MCP tool poisoning, unsafe agent actions, and vulnerable generated code.\n\n**What should I run first?**\nRun `npx agent-security-scanner-mcp scan-project . --verbosity compact`.\n\n## Links\n\n- [npm package](https://www.npmjs.com/package/agent-security-scanner-mcp)\n- [GitHub issues](https://github.com/sinewaveai/agent-security-scanner-mcp/issues)\n- [Full changelog](./CHANGELOG.md)\n- [Code review agent docs](./code-review-agent/README.md)\n\n## License\n\nMIT\n",
  "bytes": 10643,
  "sha": "d3ac3310b0fef87db0c75cb90e3ef2ee8a7e4bb1678a899ea919c9540a1312c1",
  "repo_slug": "sinewaveai/agent-security-scanner-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_sinewaveai_agent_security_scan_e8850a19/readme"
}