aisecscan

Static security scanner for AI/LLM/agentic repos — the config and code that make an AI agent do things: settings, permissions, hooks, MCP servers, agents/subagents, skills, slash commands, and CLAUDE.md. Think Checkov / Terrascan, but for your AI stack.

v1.0 scope: full check coverage today is Claude Code (.claude/, .mcp.json, CLAUDE.md). Discovery for other AI coding assistants (Cursor, Copilot, Windsurf, Cline) plus LLM app-code and AI-supply-chain checks are on the roadmap — see Roadmap below. Renamed from agentscanner to reflect that direction.

AI coding assistants are customized through powerful, trust-bearing artifacts: a hook is arbitrary code that runs on every tool call; an MCP server is an arbitrary process; a permission rule decides what the agent may do without asking; a skill or steering file (CLAUDE.md, .cursor/rules, ...) is untrusted text that steers the model. Misconfigurations and malicious contributions create real risk — code execution, credential exfil, permission bypass, supply-chain compromise, and prompt injection. aisecscan finds them, and maps findings to OWASP's LLM/Agentic/Agentic-Skills Top 10 and AIVSS severity where applicable.

Core safety invariant

aisecscan never executes what it parses. It does not run hook commands, launch MCP servers, resolve apiKeyHelper/statusLine scripts, or fetch any URL. It reads untrusted config as data only — the moment a scanner execs its input, it becomes the vulnerability.

Install

pip install aisecscan        # or: pipx install aisecscan / uvx aisecscan

Usage

aisecscan scan .                       # scan the current repo's .claude/, .mcp.json, CLAUDE.md
aisecscan scan . --include-user        # also scan ~/.claude (user scope)
aisecscan scan . --severity-threshold HIGH
aisecscan scan . --output sarif --output-file aisecscan.sarif   # for GitHub code scanning
aisecscan scan . --fail-on HIGH        # CI gate: nonzero exit on HIGH+ findings
aisecscan list-checks                  # show the check catalog

Every resource is tagged with its scope (project / local / user / managed / plugin), so a single run cleanly covers a repo, your global config, or both.

Check catalog (v1)

See DESIGN.md for the architecture, threat model, and the verified Claude Code semantics the permission checks are grounded in. A secure baseline config lives in hardened/.

CI

GitHub Actions (SARIF upload to code scanning):

- run: pipx install aisecscan
- run: aisecscan scan . --output sarif --output-file aisecscan.sarif --soft-fail
- uses: github/codeql-action/upload-sarif@v3
  with: { sarif_file: aisecscan.sarif }

pre-commit:

- repo: local
  hooks:
    - id: aisecscan
      name: aisecscan
      entry: aisecscan scan . --fail-on HIGH
      language: system
      pass_filenames: false

Roadmap

• Multi-assistant discovery — Cursor .cursor/rules, GitHub Copilot instructions, Windsurf, Cline configs, alongside Claude Code (not just .claude/).
• LLM app-code checks — unsafe prompt concatenation of untrusted input, hardcoded model API keys, missing/unsafe output handling.
• AI supply-chain checks — model source pinning/provenance, unpinned model/skill registries; cross-links to ModelScan for model-file deserialization rather than duplicating it.
• Zero-trust / agent-identity checks — shared credentials across agent identities, no credential TTL/refresh, confused-deputy pattern (untrusted-input ingestion + write/publish capability with no re-authorization gate), permission inheritance on sub-agent spawn. Maps to OWASP Agentic Top 10 ASI03 (Identity and Privilege Abuse) and AIVSS Agent Identity Impersonation / Agent Untraceability.

Track progress and file requests in Issues.

Prior art & license

Inspired by awesome-claude-security (used as inspiration and as a corpus to scan, not as a source of rule text). All rules are independently authored. License: Apache-2.0.