Ai Code Scanner

io.github.4hmetuyarPublished by GitHub account 4hmetuyarv0.3.2Updated Oct 24, 2026

Scans code for insecure LLM/AI integration: exposed keys, unsafe output, prompt injection

VerifiedSTDIODesktop onlyDeveloper Tools Security & Monitoring

Server details

Identifier: io.github.4hmetuyar/ai-code-scanner
Transport: STDIO
Runtime: Desktop only
Trust: Verified
Published: Sep 28, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified the GitHub account 4hmetuyar for this listing. That does not show the account is the product's maker.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.github.4hmetuyar%2Fai-code-scanner.svg)](https://sourceweft.com/mcp/io.github.4hmetuyar%2Fai-code-scanner?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

Scans code snippets, files, or directories for insecure LLM/AI integration patterns such as exposed keys, unsafe output handling, and prompt injection.

What you can do: Provides MCP tools scan_text, scan_file, scan_directory, and list_patterns that check code against 10 heuristic patterns in 5 categories: client-exposure, output-handling, excessive-agency, data-privacy, and prompt-injection. Each finding includes a severity and a recommendation. It also supports custom JSON rule packs and SARIF 2.1.0 output for CI/CD.
When to use it: Useful when reviewing or auditing a codebase that calls LLM APIs, to catch risks a credential-only scanner misses, such as model output passed to eval or shell, agent tools with excessive privileges, or PII placed directly into prompts. Also usable in CI pipelines via its CLI.
Requirements: Runs locally over stdio, typically launched with npx from the npm package @guardbee/mcp-ai-code-scanner, so Node.js and network access for package download are needed. No accounts, API keys, or environment variables are declared. Optional configuration via guardbee.yml.

Before you install

Findings are heuristic text-pattern matches, not full AST analysis, so results should be reviewed manually. The package sends usage telemetry by default (tool name and short parameters, not scanned code); disable it with GUARDBEE_TELEMETRY=0. Scans read local code and directories, so point it only at code you are permitted to inspect.

Installation

In SourceWeft

Open Ai Code Scanner in the dashboard and add it to a workspace.
Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@guardbee/mcp-ai-code-scanner

[npm version] [npm downloads] [License: MIT]

An MCP (Model Context Protocol) server that scans your codebase for security patterns commonly found in LLM/AI integrations.

While secret-scanner looks for leaked secrets/API keys, this package looks for patterns: how much a model's output is trusted, how privileged the tools it can call are, what data is sent to a third-party LLM — risks that a static credential scan can't catch.

Telemetry is off by default. With GUARDBEE_TELEMETRY=1 it sends the server, tool, success, duration and short parameter values such as a file path; longer strings and fields like content, token or password are replaced with a placeholder. See @guardbee/mcp-telemetry.

Claude ──► ai-code-scanner ──► Your codebase              │              ├─ Client-exposure    (dangerouslyAllowBrowser: true)              ├─ Output handling    (eval(llmOutput), unvalidated JSON.parse)              ├─ Excessive agency   (an agent tool named execute_command)              ├─ Data privacy       (email/national ID interpolated directly into a prompt)              └─ Prompt injection   (raw request data mixed into a system prompt)

Claude ──► ai-code-scanner ──► Your codebase              │              ├─ Client-exposure    (dangerouslyAllowBrowser: true)              ├─ Output handling    (eval(llmOutput), unvalidated JSON.parse)              ├─ Excessive agency   (an agent tool named execute_command)              ├─ Data privacy       (email/national ID interpolated directly into a prompt)              └─ Prompt injection   (raw request data mixed into a system prompt)

Features

10 patterns, 5 categories — client-exposure, output-handling, excessive-agency, data-privacy, prompt-injection
Every finding includes why it's risky and what to do about it (recommendation) — not just "found it"
SARIF 2.1.0 output — CI/CD integration (GitHub Code Scanning, etc.)
Config file support via guardbee.yml
Custom rule packs — extend detection with org-specific patterns (KVKK/GDPR field names, internal tool names) via JSON files, no fork required
36 unit tests — a positive and a negative (false-positive) scenario for every built-in pattern, plus custom-rule loading/validation

Quick Start

Claude Desktop / MCP Client

json

{  "mcpServers": {    "guardbee-ai-code-scanner": {      "command": "npx",      "args": ["-y", "@guardbee/mcp-ai-code-scanner"]    }  }}

{  "mcpServers": {    "guardbee-ai-code-scanner": {      "command": "npx",      "args": ["-y", "@guardbee/mcp-ai-code-scanner"]    }  }}

CLI (CI/CD)

MCP Tools

Tool	Description
`scan_text`	Scans a given text/code snippet
`scan_file`	Scans a single file
`scan_directory`	Recursively scans a directory (`node_modules`, `.git`, `dist` skipped automatically)
`list_patterns`	Lists all supported patterns by category

Detected Patterns

Category	Pattern	Severity	What it means
client-exposure	`openai_dangerously_allow_browser`	critical	OpenAI key leaked to the browser
client-exposure	`client_bundled_ai_api_key`	critical	An AI key enters the client bundle via `NEXT_PUBLIC_`/`VITE_`/`REACT_APP_`
output-handling	`eval_llm_output`	critical	Model output executed as code via `eval()`/`Function()`
output-handling	`exec_llm_output`	critical	Model output passed to a shell command (command injection)
output-handling	`llm_output_dangerously_set_inner_html`	high	Model output rendered as raw HTML (XSS)
output-handling	`llm_json_no_validation`	medium	Model output `JSON.parse`'d without schema validation
excessive-agency	`excessive_agency_tool_name`	high	A tool that grants an agent shell/code execution
excessive-agency	`unbounded_agent_loop`	medium	An agent loop with no iteration bound (cost/DoS)
data-privacy	`pii_field_in_llm_prompt`	high	Data like email/national ID/card number goes directly into a prompt
prompt-injection	`unsanitized_input_in_system_prompt`	medium	Raw request/user data mixed into a system prompt

These are heuristic findings — a static text-pattern scan, not a full AST analysis. Designed for a low false-positive rate, but every finding should still be reviewed manually.

Configuration (`guardbee.yml`)

yaml

ai-code-scanner:  fail-on: high       # any | critical | high | medium | low | none  max-files: 5000  rules-dir: .guardbee/rules   # custom rule packs, see below  exclude:    - ".test.ts"    - "fixtures/"

ai-code-scanner:  fail-on: high       # any | critical | high | medium | low | none  max-files: 5000  rules-dir: .guardbee/rules   # custom rule packs, see below  exclude:    - ".test.ts"    - "fixtures/"

Custom rules

Built-in patterns cover common AI/LLM integration mistakes, but field names and internal conventions (e.g. which prop names carry KVKK-regulated data) are project-specific. Drop one or more JSON files into .guardbee/rules/ (configurable via rules-dir) and they're merged with the built-ins at scan time — for both the CLI and the MCP server (list_patterns marks them (custom)).

A file holds a single rule object or an array of them:

json

{  "id": "kvkk_musteri_tc_no",  "name": "musteriTcNo interpolated into a prompt",  "category": "data-privacy",  "pattern": "musteriTcNo",  "flags": "gi",  "severity": "high",  "recommendation": "Mask the national ID before it enters the prompt."}

{  "id": "kvkk_musteri_tc_no",  "name": "musteriTcNo interpolated into a prompt",  "category": "data-privacy",  "pattern": "musteriTcNo",  "flags": "gi",  "severity": "high",  "recommendation": "Mask the national ID before it enters the prompt."}

category is one of client-exposure | output-handling | excessive-agency | data-privacy | prompt-injection | cost-control; severity is one of critical | high | medium | low. pattern is a JS regex source string (flags defaults to "g"). A rule id that collides with a built-in or another custom rule is rejected — the scanner keeps running but reports the problem on stderr and skips that entry.

Development

License

MIT — GuardBee

Feedback

Questions, ideas, or a false positive? Start a thread in GitHub Discussions or open an issue. If GuardBee is useful to you, a ⭐ on the repository helps others find it.

Source: packages/ai-code-scanner/README.md at commit 040e072

Tools

SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

v0.3.2LatestSep 29, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

Reached in the last 30 days25 pts
Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.
Auth declared10 pts
Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.
Tools listed15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
License10 pts