Aisecscan

aisecscan

**Static security scanner for AI/LLM/agentic repos** — the config and code that make an AI agent do things: settings, permissions, hooks, MCP servers, agents/subagents, skills, slash commands, and `CLAUDE.md`. Think *Checkov / Terrascan, but for your AI stack.*

**v1.0 scope:** full check coverage today is Claude Code (`.claude/`, `.mcp.json`, `CLAUDE.md`). Discovery for other AI coding assistants (Cursor, Copilot, Windsurf, Cline) plus LLM app-code and AI-supply-chain checks are on the roadmap — see [Roadmap](#roadmap) below. Renamed from `agentscanner` to reflect that direction.

AI coding assistants are customized through powerful, trust-bearing artifacts: a hook is arbitrary code that runs on every tool call; an MCP server is an arbitrary process; a permission rule decides what the agent may do without asking; a skill or steering file (`CLAUDE.md`, `.cursor/rules`, ...) is untrusted text that steers the model. Misconfigurations and malicious contributions create real risk — code execution, credential exfil, permission bypass, supply-chain compromise, and prompt injection. `aisecscan` finds them, and maps findings to OWASP's LLM/Agentic/Agentic-Skills Top 10 and AIVSS severity where applicable.

Core safety invariant

**aisecscan never executes what it parses.** It does not run hook commands, launch MCP servers, resolve `apiKeyHelper`/`statusLine` scripts, or fetch any URL. It reads untrusted config as *data only* — the moment a scanner execs its input, it becomes the vulnerability.

Install

pip install aisecscan        # or: pipx install aisecscan / uvx aisecscan

Usage

aisecscan scan .                       # scan the current repo's .claude/, .mcp.json, CLAUDE.md
aisecscan scan . --include-user        # also scan ~/.claude (user scope)
aisecscan scan . --severity-th