SecureAI-Scan

Offline CLI that scans TypeScript, JavaScript, and Python for LLM, MCP, Agent Skill, and RAG risks — import-resolved dataflow evidence, zero default false positives, mapped to OWASP LLM/ASI/MCP Top 10.

Most scanners in this space pattern-match a keyword and call it a finding. SecureAI-Scan traces the actual source → flow → sink path through real, import-resolved code — and a default scan shows you only what it can prove. No account, no cloud upload, nothing leaves your machine.

Covers the official OWASP Top 10 for LLM Applications 2026, Top 10 for Agentic Applications (2026), and the MCP Top 10 from launch week.

Get started in 30 seconds

npx --yes [email protected] scan .

No account, cloud upload, Python interpreter, or configuration required. TypeScript, JavaScript, Python, MCP configs, and Agent Skill bundles are detected automatically.

Measured 0.9.0 release candidate: 136/136 tests · 88.08% statement coverage · 12,676 files across 9 public repositories · 0 new default-tier fingerprints against the reviewed baseline. Evidence · methodology and limits

  ▌ HIGH  AI001  Prompt injection via user input
    PROVEN  LLM01:2026 Prompt Injection

    source src/chat.ts:8   request data `req.body.input`
    flow   src/chat.ts:13  passed as `systemPrompt`
    sink   src/chat.ts:10  openai.chat.completions.create — system role (OpenAI)

    fix    Keep system prompts static; pass user input as a user-role message.

Is this for you? SecureAI-Scan is scoped deliberately to LLM, MCP, and RAG/agent risks — prompt injection, tool poisoning, unsafe output handling, vector-store access control, agent-skill poisoning. It is not a general SAST or secrets scanner, and doesn't try to be one; a known-malicious package with no LLM-shaped payload (e.g. a hardcoded exfiltration address in an email API call) is caught by the offline advisory list (DEP003), not a pattern rule. If your codebase talks to an LLM, an MCP server, a vector store, or ships Agent Skills, this is built for you.

_{New: static config scanning for LiteLLM Proxy (config.yaml) — hardcoded secrets, plaintext provider endpoints, missing guardrails. See Rules (LLC001–LLC003).}

Contents

• Why this scanner is different
• How it compares
• Get started in 30 seconds
• See it work
• Commands
• GitHub Action
• Pre-commit hook
• Rules
• Architecture
• MCP server (use it from Claude)
• Claude Skill
• Trust and release assurance
• The precision contract
• Testing & benchmarking
• Roadmap
• Contributing

Why this scanner is different

• Evidence tiers, not noise. Every finding is proven (traced dataflow or parsed config fact), likely (resolved sink, one heuristic hop), or heuristic. A default scan shows only proven + likely. Heuristics are opt-in via --paranoid.
• Import-resolved detection. A call is only an "LLM call" if it resolves to a real SDK import (openai, @anthropic-ai/sdk, ai, @google/genai, LangChain, Bedrock, …). Your Google Maps client will never be flagged as an LLM again.
• Precision-gated, and benchmarked against real repos. The test suite asserts every vulnerable fixture fires and every safe fixture stays clean — a false positive on the safe corpus fails the build. Beyond that, npm run regression scans real public repos (OpenAI/Anthropic/Vercel AI SDKs, official MCP servers, LlamaIndex) against a committed, hand-reviewed baseline and fails on any new proven/likely finding. See Testing & benchmarking for the actual before/after numbers, or What we found scanning real repos for the story behind them — a 6/6 catch rate on a labeled malicious-skill corpus, and why we're not calling llama_index "vulnerable" over an honest library-level finding. Discussion write-up →
• SARIF for GitHub code scanning. --output report.sarif puts findings inline on pull requests and in the Security tab.
• AI-BOM. secureai-scan bom . builds a syntax-derived inventory of SDKs, model IDs, vector stores, agent frameworks, and MCP servers, mapped to OWASP LLM Top 10 / EU AI Act documentation needs.
• MCP config scanning. Parses .mcp.json, claude_desktop_config.json, .cursor/mcp.json: unpinned npx -y servers, inline secrets, plaintext HTTP transports.
• MCP tool-poisoning detection. Catches the pattern behind the WhatsApp MCP rug-pull and postmark-mcp backdoor — invisible Unicode, agent-directed injection phrases, and cross-tool shadowing in tool names/descriptions, statically, before you ever run the server.
• MCP command-injection detection. Flags MCP stdio transport command/args built from request data — the pattern behind the 2026 MCP STDIO RCE disclosure.
• Agent Skill poisoning detection. The same invisible-Unicode, injection-phrase, and shadowing checks applied to SKILL.md files — Agent Skills load into context wholesale, so a poisoned skill is a poisoned tool description by another name.
• Evasion-resistant skill scanning. Skill bundles are scanned as directories, not just their SKILL.md, and every content check runs against deobfuscated variants of the text. This targets the published techniques — homoglyphs, zero-width splitting, payloads staged in .git/ or build/, exfiltration hidden in a *.test.ts file — that bypassed >90% of the nine scanners surveyed in Cloak and Detonate (arXiv:2607.02357). See Evasion resistance.
• Known-vulnerable and known-malicious package advisories, version-aware. Checks every dependency and every MCP-launched package against a bundled advisory snapshot — a hand-curated list of documented in-the-wild backdoors, plus HIGH/CRITICAL OSV advisories for an LLM/MCP/RAG package watchlist, regenerated by scripts/sync-advisories.js. Runs offline on every scan, no flag required. A CVE only fires when your pinned version is provably inside the affected range; a documented-malicious package fires even on an ambiguous range, because installing a backdoor is unrecoverable.
• Local-first. Nothing leaves your machine.

How it compares