Code Security Scanner

MCP Server for local code security scanning - detects secrets, vulnerable dependencies, and insecure code patterns

Scan your local codebase for security vulnerabilities, hardcoded secrets, and insecure coding patterns — all from your AI assistant via MCP (Model Context Protocol).

- AWS Access Keys & Secret Keys
- GitHub tokens (personal, OAuth, app)
- Stripe API keys (live/test)
- Slack tokens & webhooks
- Google Cloud / Firebase credentials
- Database connection strings
- JWT tokens & private keys (RSA, DSA, EC)
- npm auth tokens, Telegram bot tokens, SendGrid API keys
- Generic API keys & password assignments

- package.json(npm/yarn/pnpm)
- requirements.txt,Pipfile,pyproject.toml(Python)
- go.mod(Go)
- Cargo.toml(Rust)
- pom.xml,build.gradle(Java)

Checks against a built-in database of 45+ CVEs across JavaScript, Python, Java, Go, and Rust ecosystems.

- SQL Injection: String concatenation in queries, raw SQL builders
- XSS: innerHTML, dangerouslySetInnerHTML, v-html
- Command Injection: os.system, subprocess shell=True, eval/exec, child_process.exec
- Path Traversal: Unsanitized file paths
- Insecure Deserialization: pickle, yaml.load, marshal
- Configuration Issues: Debug mode, CORS wildcard, hardcoded JWT secrets
- Information Leakage: Stack trace exposure, directory listing

git clone https://github.com/214070779/code-scanner-mcp.git cd code-scanner-mcp pip install mcp pydantic npx @modelcontextprotocol/inspector python3 server.py

{ "mcpServers": { "code-scanner": { "command": "python3", "args": ["/path/to/code-scanner-mcp/server.py"] } } }

"Scan my project for security issues"→ AI callsscan_directory(path="./my-project")

"Check this file for secrets before committing"→ AI callsscan_file(path="./src/config.ts")

"Are there any vulnerable npm packages?"→ AI callsscan_dependencies(path=".")

- MCPize
- Smithery
- PulseMCP
- MCP.so
- All MCP-compatible AI clients

# Clone and install git clone https://github.com/214070779/code-scanner-mcp.git cd code-scanner-mcp pip install mcp pydantic # Run tests python3 -c "from server import mcp; print('OK:', list(mcp._tool_manager._tools.keys()))" # Run with inspector npx @modelcontextprotocol/inspector python3 server.py

RepoFortify is a remote MCP server for production-readiness and security scanning. Connect it to your AI coding tool — Lovable, ChatGPT, Codex, Claude Code, Cursor, and other MCP clients — and scan your repository, review risk findings, and get AI fix plans without leaving where you build. Authentication required on every request; your data stays isolated to you.