Code Security Scanner MCP Server

Scan your local codebase for security vulnerabilities, hardcoded secrets, and insecure coding patterns — all from your AI assistant via MCP (Model Context Protocol).

Features

🔑 Secrets Detection (24+ patterns)

• AWS Access Keys & Secret Keys
• GitHub tokens (personal, OAuth, app)
• Stripe API keys (live/test)
• Slack tokens & webhooks
• Google Cloud / Firebase credentials
• Database connection strings
• JWT tokens & private keys (RSA, DSA, EC)
• npm auth tokens, Telegram bot tokens, SendGrid API keys
• Generic API keys & password assignments

📦 Dependency Vulnerability Scanning

Automatically detects and parses:

• `package.json` (npm/yarn/pnpm)
• `requirements.txt`, `Pipfile`, `pyproject.toml` (Python)
• `go.mod` (Go)
• `Cargo.toml` (Rust)
• `pom.xml`, `build.gradle` (Java)

Checks against a built-in database of 45+ CVEs across JavaScript, Python, Java, Go, and Rust ecosystems.

🛡️ Insecure Code Pattern Detection

• SQL Injection: String concatenation in queries, raw SQL builders
• XSS: innerHTML, dangerouslySetInnerHTML, v-html
• Command Injection: os.system, subprocess shell=True, eval/exec, child_process.exec
• Path Traversal: Unsanitized file paths
• Insecure Deserialization: pickle, yaml.load, marshal
• Configuration Issues: Debug mode, CORS wildcard, hardcoded JWT secrets
• Information Leakage: Stack trace exposure, directory listing

Tools

Quick Start

Prerequisites

• Python 3.11+
• `pip install mcp pydantic`

Run with MCP Inspector

git clone https://github.com/214070779/code-scanner-mcp.git
cd code-scanner-mcp
pip install mcp pydantic
npx @modelcontextprotocol/inspector python3 server.py

Configure in your AI Client

Add to your MCP settings:

{
  "mcpServers": {
    "code-scanner": {
      "command": "python3",
      "args": ["/path/to/code-scanner-mcp/server.py"]
    }
  }
}

Example Usage

"Scan my project for security issues"

→ AI calls `scan_directory(path="./my-project")`

"Check this file for secrets before committing"

→ AI calls `scan_file(path="./src/config.ts")`

"Are there any vulnerable npm packages?"

→ AI calls `scan_dependencies(path=".")`

Supported Platforms

• MCPize
• Smithery
• PulseMCP
• MCP.so
• All MCP-compatible AI clients

Development

# Clone and install
git clone https://github.com/214070779/code-scanner-mcp.git
cd code-scanner-mcp
pip install mcp pydantic

# Run tests
python3 -c "from server import mcp; print('OK:', list(mcp._tool_manager._tools.keys()))"

# Run with inspector
npx @modelcontextprotocol/inspector python3 server.py

License

MIT