agent-security-scanner
Security scanner MCP server that protects AI coding agents from generating vulnerable code. Features: • 275+ security rules for Python, JavaScript, TypeScript, Java, Go, Ruby, PHP, C/C++, Rust, C#, Terraform, Kubernetes • AST-based detection with tree-sitter (falls back to regex when unavailable) • Taint analysis for tracking user input to dangerous sinks • Package hallucination detection across 4.3M+ packages (npm, PyPI, RubyGems, crates.io, pub.dev, CPAN, Raku) • Prompt injection detection for AI agent security • Automatic fix suggestions for common vulnerabilities • CWE/OWASP metadata for compliance Tools: • scan_security - Scan files for vulnerabilities • fix_security - Auto-fix security issues • check_package - Verify if a package exists or is hallucinated • scan_agent_prompt - Detect prompt injection attacks • list_security_rules - View all available rules • list_package_stats - Package database statistics Zero config - works instantly with npx.
Composite of vulnerability cleanliness, spec conformance, provenance, stability, and usage signals — scanned and weighted by Cognium. Human and agent signals are tracked separately.
View full trust & usage report →Metadata
- Version
- 1.0.0
- Skill type
- atomic
- Execution layer
- container
- Category
- database
- Source
- Smithery
- Author type
- human
- Updated
- 2026-05-14
Use via MCP
Resolve agent-security-scanner from your agent
Streamable HTTP transport at https://api.skillsregistry.net/mcp. No auth for read tools. Discovery: .well-known/mcp.json.
One command in your shell — Claude Code wires it up and verifies the connection. Run /mcp in any session to confirm.
claude mcp add --transport http --scope user skillsregistry https://api.skillsregistry.net/mcp--scope user for --scope project to commit it to .mcp.json.