aisecscan

Static security scanner for AI/LLM/agentic repos — settings, permissions, hooks, MCP servers, agents/subagents, skills, slash commands, and steering files. Think Checkov / Terrascan, but for your AI stack.

v1.0 check coverage is Claude Code (.claude/, .mcp.json, CLAUDE.md); multi-assistant discovery (Cursor, Copilot, Windsurf, Cline), LLM app-code checks, AI supply-chain checks, and zero-trust/agent-identity checks are on the roadmap. Renamed from agentscanner.

AI coding assistants are customized through powerful, trust-bearing artifacts: a hook is arbitrary code that runs on every tool call; an MCP server is an arbitrary process; a permission rule decides what the agent may do without asking; a skill or steering file is untrusted text that steers the model. Misconfigurations and malicious contributions create real risk — code execution, credential exfil, permission bypass, supply-chain compromise, and prompt injection. aisecscan finds them.

Core safety invariant

Important

aisecscan never executes what it parses. It does not run hook commands, launch MCP servers, resolve apiKeyHelper/statusLine scripts, or fetch any URL. It reads untrusted config as data only — the moment a scanner execs its input, it becomes the vulnerability.

Install

pip install aisecscan        # standard
pipx install aisecscan       # isolated env (recommended for CLI tools)
uvx aisecscan                # ephemeral run — no install needed

Quick start

# Scan the current repo's .claude/, .mcp.json, CLAUDE.md
aisecscan scan .

# Also scan your ~/.claude (user scope)
aisecscan scan . --include-user

# Only report HIGH and above
aisecscan scan . --severity-threshold HIGH

# CI gate: nonzero exit on any HIGH+ finding
aisecscan scan . --fail-on HIGH

# SARIF output for GitHub code scanning
aisecscan scan . --output sarif --output-file aisecscan.sarif

# Browse the full check catalog
aisecscan list-checks

Every resource is tagged with its scope (project / local / user / managed / plugin), so a single run cleanly covers a repo, your global config, or both.

What it scans

Artifact	Locations	Threats it catches
Settings	.claude/settings.json, ~/.claude/settings.json	Permission bypass, endpoint redirect, secrets
Hooks	hooks key in settings, agent frontmatter	Remote code exec, shell injection, network calls
MCP servers	.mcp.json, settings mcpServers	Plaintext secrets, cleartext transport, unpinned packages
Agents / subagents	.claude/agents/*.md	Over-privilege, prompt injection
Skills	.claude/skills/*/SKILL.md	Shell access, unsigned code, obfuscated payloads
Memory / steering	CLAUDE.md, imported memory	Prompt injection, hidden unicode

See the Check Catalog for the full list of checks, or the Architecture page for the threat model and design rationale.

Prior art & license

Inspired by awesome-claude-security (used as inspiration and as a corpus to scan, not as a source of rule text). All rules are independently authored. License: Apache-2.0.