GoThreatScope

This tool also acts as aModel Context Protocol (MCP)server, allowing IDEs such asCursororVisual Studio Codeto query its results using natural language.
For example, you can ask:

"Analyze my project and show me which dependencies look risky."

The MCP interface exposes tools and resources so other systems or LLMs can retrieve structured SBOMs, vulnerability reports, and secret findings directly from the local filesystem.

GoThreatScope performs an high-level security inspection of a project directory and organizes the results for both human and automated analysis.

It combines several capabilities into a single workflow:

Each module works independently or as part of theanalyzepipeline.
All results are stored locally undergothreatscope_store/and reused when no changes are detected.

GoThreatScope is organized into clear, modular packages.
Each package handles a specific security function or integration point, making the tool easy to extend or reuse in other projects.

GoThreatScope │ ├── cmd/gothreatscope/ # CLI entrypoint and MCP server mode │ └── main.go # CLI commands and MCP wiring │ ├── pkg/ │ ├── sbom/ # SBOM generation logic │ ├── vuln/ # OSV-based vulnerability and malware detection │ ├── secrets/ # Gitleaks and builtin secret scanner │ ├── analysis/ # Full pipeline and storage/diff logic │ ├── metrics/ # Local and remote metrics sender │ └── mcp/ # MCP tools and resources implementation │ └── gothreatscope_store/ # Automatically generated per-project store └── <project_id>/ ├── latest/ │ ├── sbom.json │ ├── vuln.json │ ├── secrets.json │ ├── metrics.json │ └── bundle.json └── history/<run_id>/

Each project scanned by GoThreatScope receives its own identifier, derived from the SHA-256 hash of its absolute path. All results are written into that project’s folder under gothreatscope_store/, and new files are only created when differences are detected compared to the previous run.

GoThreatScope operates through independent modules that can run individually or together as part of a complete analysis pipeline.

Every scanned project is assigned a unique identifier derived from the SHA-256 hash of its absolute path.
This ensures consistent tracking across runs without revealing directory names.

Scan results are stored under thegothreatscope_store/directory, grouped by project ID.
Each module writes its own JSON artifact inside alatest/folder, and keeps a short history of past results.

gothreatscope_store/ └── a93bf44e3e9c/ ├── latest/ │ ├── sbom.json │ ├── vuln.json │ ├── secrets.json │ └── metrics.json └── history/20251007T215959Z/

Before saving, GoThreatScope compares digests (hashes) of the new results with those from the previous run. If there are no changes, the stored files remain untouched, avoiding redundant writes and unnecessary history entries.

Each scan produces ametrics.jsonfile summarizing timing, findings, and environment details. Metrics are always stored locally and can optionally be sent to a remote endpoint defined by theGOTHREATSCOPE_METRICS_URLvariable.

When running in--mcpmode, GoThreatScope exposes its analysis capabilities as tools that can be invoked directly by LLMs or IDEs. Results are returned as structured JSON withfile://URIs pointing to saved artifacts, allowing the calling system to read or display them without rerunning scans.

go install github.com/anotherik/gothreatscope/cmd/gothreatscope@latest

After installation, the binary gothreatscope will be available in your $GOBIN path.

# Navigate to the project directory cd /path/to/GoThreatScope # Build the binary go build -o ./bin/gothreatscope ./cmd/gothreatscope # Make it executable chmod +x ./bin/gothreatscope

You can run GoThreatScope in a container using the providedDockerfile.

Build image metadata from your local Git state:

# Docker docker build -t gothreatscope:latest \ --build-arg VERSION=0.0.0 \ --build-arg COMMIT=$(git rev-parse --short HEAD) \ --build-arg DATE=$(date -u +%Y-%m-%dT%H:%M:%SZ) . # Podman podman build -t gothreatscope:latest \ --build-arg VERSION=0.0.0 \ --build-arg COMMIT=$(git rev-parse --short HEAD) \ --build-arg DATE=$(date -u +%Y-%m-%dT%H:%M:%SZ) .

Run a full analysis against the current repository:

# Docker docker run --rm -v "$PWD":/workspace gothreatscope:latest analyze --path /workspace # Podman podman run --rm -v "$PWD":/workspace gothreatscope:latest analyze --path /workspace

# Docker docker run --rm -i -v "$PWD":/workspace gothreatscope:latest --mcp # Podman podman run --rm -i -v "$PWD":/workspace gothreatscope:latest --mcp

The runtime image includes HTTPS CA certificates and runs as a non-root user. Ifgitleaksis not present in the container, GoThreatScope automatically uses the builtin secret scanner.

IfGitleaksis not installed, GoThreatScope automatically uses its internal secret-scanning engine.

GoThreatScope can be used directly from the command line to perform individual scans or run the full analysis pipeline.

Once a scan is completed, GoThreatScope also exposesresourcesthat can be accessed by compatible MCP clients (e.g., Cursor, VS Code). These resources allow the MCP clients to fetch structured analysis outputs like:

- SBOMs— stored assbom.json
- Vulnerability reports— stored asvuln.json
- Secrets findings— stored assecrets.json
- Metrics— stored asmetrics.json

Resources are automatically listed through the MCP protocol methods:

- resources/listlists all stored artifacts across scanned projects.
- resources/readretrieves the content of a specific file via afile://URI (e.g., local artifact path).

{ "uri": "file:///home/user/gothreatscope_store/a93bf44e3e9c/latest/vuln.json", "changed": true, "counts": { "vulns": 5 }, "note": "Vulnerability report updated (change detected)" }

Using these endpoints, IDEs or connected LLMs can request analysis results, open the corresponding JSON artifacts, or cross-reference findings without rerunning the scans.

GoThreatScope can be used directly insideCursoror any IDE that supports theModel Context Protocol (MCP).

Once installed, configure Cursor to recognize GoThreatScope as an MCP server:

Option A: Global ConfigurationAdd to your Cursor settings (File → Preferences → Settings → Extensions → MCP):