Prism Scanner
About
Security scanner for AI Agent skills, plugins, and MCP servers. 39+ detection rules with AST taint tracking, A-F grading, and post-uninstall residue cleanup.
Explore
- Taint Analysis — Tracks data flow from sources (env vars, user input) to sinks (shell, network) within each file
- Multi-Platform — Scans ClawHub skills, MCP servers, npm packages, and pip packages with platform-aware rules
- Zero Dependencies on Target — Pure static analysis; never executes scanned code
- Residue Scanner — Detects persistence mechanisms, shell config pollution, and credential leaks left by uninstalled tools
- Safe Cleanup — Three-tier workflow (scan -> plan -> apply) with automatic backup and --rollback
- Suppression — Use .prismignore to suppress known findings by rule ID with justification
- Offline Mode — Run with --offline to skip all external lookups
---
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
Prism ScannerCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
pip install prism-scanner
npx prism-scanner scan https://github.com/user/skill-repo
```
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"prism scanner": {
"prism-scanner": {
"command": "npx",
"args": [
"prism-scanner",
"scan",
"https://github.com/user/skill-repo"
]
}
}
}
}McpServers
{
"prism-scanner": {
"command": "npx",
"args": [
"prism-scanner",
"scan",
"https://github.com/user/skill-repo"
]
}
}:large_blue_diamond: Prism Scanner
[
[
Security scanner for AI Agent skills, plugins, and MCP servers.
<!-- mcp-name: io.github.aidongise-cell/prism-scanner -->
Prism analyzes code for malicious behavior before you install it — and checks your system for leftover threats after you uninstall.
> Unlike marketplace-only trust scores, Prism gives you full lifecycle coverage with code-level transparency — pre-install, runtime, and post-uninstall — across every platform, completely open source.
---
Why Prism?
| | Marketplace Trust Scores | Prism Scanner |
|--------------------|:------------------------:|:-----------------:|
| Pre-install | :white_check_mark: Reputation score | :white_check_mark: Deep code analysis |
| Post-uninstall | :x: | :white_check_mark: Residue & persistence scan |
| Inspection | Black-box rating | Code-level, rule-by-rule |
| Platforms | Single ecosystem | ClawHub, MCP, npm, pip |
| Source | Closed | Open (Apache 2.0) |
| Execution | Requires upload | Local-first, offline OK |
---
Quick Start
```bash
pip install prism-scanner
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
