$ loading_
Scan agent-generated code for vulnerabilities, prompt injection, and semantic security issues.
This MCP tool appears to be an open-source MIT project with no required secrets and no declared remote endpoints, with no clear high-risk red flags in the provided materials. Caution is still warranted because it has local code-scanning/execution-type capabilities, while the README is absent, community adoption is low, and maintenance status is unknown, limiting audit confidence.
The materials state that no keys or environment variables are required; no API tokens, account secrets, or obvious credential-abuse surface are indicated.
No remote endpoints are declared, and the provided materials do not show a need to send code or user data to external services; based on current information, there is no clear outbound data path.
The objective checks mark it as executes-code, and its description involves security scanning and code review via MCP/CLI, implying it may run scanning logic or related local processes. This is a normal capability for such tools, but it should be run in a constrained environment.
To scan for vulnerabilities, packages, and prompt injection, the tool would typically need to read local repositories and related files; the current materials do not show write scope or extra system permission requests, so there is no clear over-privilege red flag, but it should be assumed to access project source data.
Positive factors include being open source under the MIT License, which allows source review; however, it comes from a third-party registry, has only 0 GitHub stars, no README, and unknown maintenance status, which reduces supply-chain trust and verifiability. Review the source and pin dependencies before use.
Copy the install command and let the AI configure it · recommended for beginners
No copy-paste install info for "agent-security-scanner-mcp" yet — see the docs or source repo.
Use agent-security-scanner-mcp to scan this repository’s AI-generated code, identify common vulnerabilities, suspicious dependencies, and hallucinated packages, then provide remediation steps ranked by severity.
A security scan report with vulnerabilities, severity levels, affected files, and remediation advice.
Inspect this AI assistant workflow’s input handling, identify possible prompt injection entry points, privilege-escalation instruction flows, and unsafe tool calls, then suggest mitigations.
An analysis of prompt injection risks detailing attack paths, impact scope, and recommended safeguards.
Perform a semantic security review of this commit, analyzing not just syntax-level issues but also authentication, authorization, secret handling, input validation, and data leakage risks.
A developer-focused security review highlighting high-risk logic flaws and actionable fixes.
Scan codebases for LLM usage, AI frameworks, and exposed secrets.
Scan AI agents, MCP servers, and skills for security risks.
Scan AI agent code for security issues from MCP-compatible clients.
Audit MCP servers and AI packages for security and supply chain risks.
Scan MCP servers for runtime, static, config, dependency, and compliance risks.
Audit MCP configs for exposed access, secrets, models, and compliance AI-BOMs.