AI Scanner

io.github.Aakashbhardwaj27Published by GitHub account Aakashbhardwaj27v1.0.6Updated Oct 24, 2026

Scan codebases for LLM/AI SDK usage, exposed API tokens, and hardcoded secrets.

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Local MCP server that lets an assistant scan a codebase for AI/LLM SDK usage, exposed API tokens and hardcoded secrets.

What you can do
  • Run a full scan of a directory for LLM SDKs, AI frameworks, exposed tokens and hardcoded secrets with severity levels
  • Run a pass/fail security check for exposed credentials only, suited to pre-commit checks
  • Produce an AI stack inventory of SDKs, frameworks, models and API endpoints without secret detection
  • Tune scans with options such as AI-only mode, including .env files, and endpoint or model detection
When to use it
Useful when you want an assistant to audit a project before committing or pushing, check for leaked API keys and other credentials, or get an overview of which AI SDKs, frameworks and models a codebase relies on.
Requirements
Runs as a local process via npx from the npm package ai-scanner-mcp; needs Node.js and a local MCP client such as Claude Code, Claude Desktop, Cursor or Windsurf. No accounts, API keys or environment variables are declared.
Before you install
Scanning can read .env files and other credential-bearing files when that option is enabled, so results may surface secret values in the conversation; review what is shared before sending scan output anywhere. Scans are read-only but cover whatever path you point them at.

Installation

In SourceWeft

  1. Open AI Scanner in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

[ai-scanner logo]

ai-scanner-mcp

MCP server for ai-scanner - let AI agents scan codebases for LLM usage, AI frameworks, and exposed secrets.

[License: MIT] [Node.js] [MCP]

An MCP server that exposes ai-scanner as tools for AI agents. Works with Claude Code, Claude Desktop, Cursor, Windsurf, and any MCP-compatible client.

Tools

ToolDescription
scan_directoryFull scan — LLM SDKs, AI frameworks, exposed tokens, and hardcoded secrets with severity levels
check_secretsSecurity check — pass/fail scan for exposed credentials only. Perfect for pre-commit checks
ai_inventoryAI stack overview — which SDKs, frameworks, models, and API endpoints are used (no secret detection)

Setup

Claude Code

bash
claude mcp add ai-scanner npx ai-scanner-mcp

Claude Desktop

Add to your claude_desktop_config.json:

json
{  "mcpServers": {    "ai-scanner": {      "command": "npx",      "args": ["ai-scanner-mcp"]    }  }}

Config file location:

  • macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
  • Windows: %APPDATA%\Claude\claude_desktop_config.json

Cursor

Add to .cursor/mcp.json in your project:

json
{  "mcpServers": {    "ai-scanner": {      "command": "npx",      "args": ["ai-scanner-mcp"]    }  }}

Windsurf

Add to ~/.windsurf/mcp.json:

json
{  "mcpServers": {    "ai-scanner": {      "command": "npx",      "args": ["ai-scanner-mcp"]    }  }}

Example Usage

Once connected, you can ask your AI agent:

  • "Scan this project for any exposed API keys"
  • "Check if there are any hardcoded secrets before I commit"
  • "What AI SDKs and frameworks does this codebase use?"
  • "Run a security scan on ./src and tell me if it's safe to push"
  • "Give me an AI inventory of this project"

Tool Details

scan_directory

Full scan with all detection categories. Parameters:

ParameterTypeDefaultDescription
directorystringrequiredPath to scan
ai_onlybooleanfalseSkip generic secrets (Stripe, GitHub, etc.)
scan_envbooleanfalseInclude .env files
include_endpointsbooleantrueDetect LLM API endpoint URLs
include_modelsbooleantrueDetect model name references

check_secrets

Security-focused pass/fail check. Parameters:

ParameterTypeDefaultDescription
directorystringrequiredPath to scan
ai_onlybooleanfalseOnly check AI tokens
scan_envbooleanfalseInclude .env files

ai_inventory

AI stack awareness (no secret detection). Parameters:

ParameterTypeDefaultDescription
directorystringrequiredPath to scan

Detection Coverage

  • AI Tokens (20+) — OpenAI, Anthropic, Google, AWS, HuggingFace, Groq, Replicate, and more
  • Generic Secrets (59) — Stripe, Twilio, GitHub, Slack, Discord, database URIs, private keys, JWTs
  • LLM SDKs (23) — OpenAI, Anthropic, Google Gemini, LiteLLM, AWS Bedrock, and more
  • AI Frameworks (24) — LangChain, LlamaIndex, CrewAI, AutoGen, DSPy, Vercel AI SDK, and more
  • 145 total detection patterns

License

MIT

Source: README.md at commit d1be69e

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.0.6LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts