Ai Code Scanner

io.github.GuardBeePublished by GitHub account GuardBeev0.5.1Updated Nov 3, 2026

Scans code for insecure LLM/AI integration: exposed keys, unsafe output, prompt injection

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Scans code snippets, files and directories for insecure LLM/AI integration patterns such as exposed keys, unsafe output handling and prompt injection.

What you can do
  • Scan a text string or code snippet for insecure AI/LLM integration patterns
  • Scan a single file, or recursively scan a directory while skipping node_modules, .git, dist and binary files
  • List the built-in detection patterns by category, including any custom rules loaded from a rules directory
  • Report findings with severity, an explanation of the risk and a recommendation, and support SARIF output for CI use
When to use it
Useful when reviewing or auditing code that calls LLMs or builds agents, and you want an assistant to flag risky patterns like client-exposed keys, eval of model output, over-privileged agent tools, PII in prompts or unsanitized system prompts.
Requirements
Runs locally over stdio, typically launched with npx from the npm package @guardbee/mcp-ai-code-scanner, so Node.js and network access for the package download are needed. No authentication, environment variables or headers are declared. Optional configuration via guardbee.yml and custom rule JSON files in a rules directory.
Before you install
Findings are heuristic text-pattern matches, not full AST analysis, so each result should be reviewed manually. Telemetry is off by default; setting GUARDBEE_TELEMETRY=1 sends server, tool, success, duration and short parameter values such as file paths to a third-party telemetry package, with longer strings and fields like content, token or password replaced by a placeholder. Scans read your source files.

Installation

In SourceWeft

  1. Open Ai Code Scanner in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@guardbee/mcp-ai-code-scanner

🇬🇧 English | 🇹🇷 Türkçe | 🇨🇳 中文 | 🇯🇵 日本語 | 🇰🇷 한국어 | 🇧🇷 Português | 🇪🇸 Español | 🇩🇪 Deutsch

[npm version] [npm downloads] [License: MIT]

An MCP (Model Context Protocol) server that scans your codebase for security patterns commonly found in LLM/AI integrations.

While secret-scanner looks for leaked secrets/API keys, this package looks for patterns: how much a model's output is trusted, how privileged the tools it can call are, what data is sent to a third-party LLM — risks that a static credential scan can't catch.

Telemetry is off by default. With GUARDBEE_TELEMETRY=1 it sends the server, tool, success, duration and short parameter values such as a file path; longer strings and fields like content, token or password are replaced with a placeholder. See @guardbee/mcp-telemetry.

Claude ──► ai-code-scanner ──► Your codebase              │              ├─ Client-exposure    (dangerouslyAllowBrowser: true)              ├─ Output handling    (eval(llmOutput), unvalidated JSON.parse)              ├─ Excessive agency   (an agent tool named execute_command)              ├─ Data privacy       (email/national ID interpolated directly into a prompt)              └─ Prompt injection   (raw request data mixed into a system prompt)

Features

  • 10 patterns, 5 categories — client-exposure, output-handling, excessive-agency, data-privacy, prompt-injection
  • Every finding includes why it's risky and what to do about it (recommendation) — not just "found it"
  • SARIF 2.1.0 output — CI/CD integration (GitHub Code Scanning, etc.)
  • Config file support via guardbee.yml
  • Custom rule packs — extend detection with org-specific patterns (KVKK/GDPR field names, internal tool names) via JSON files, no fork required
  • 36 unit tests — a positive and a negative (false-positive) scenario for every built-in pattern, plus custom-rule loading/validation

Quick Start

Claude Desktop / MCP Client

json
{  "mcpServers": {    "guardbee-ai-code-scanner": {      "command": "npx",      "args": ["-y", "@guardbee/mcp-ai-code-scanner"]    }  }}

CLI (CI/CD)

bash
npx @guardbee/mcp-ai-code-scanner scan ./src --fail-on=high --format=sarif > results.sarif

MCP Tools

ToolDescription
scan_textScans a given text/code snippet
scan_fileScans a single file
scan_directoryRecursively scans a directory (node_modules, .git, dist skipped automatically)
list_patternsLists all supported patterns by category

Detected Patterns

CategoryPatternSeverityWhat it means
client-exposureopenai_dangerously_allow_browsercriticalOpenAI key leaked to the browser
client-exposureclient_bundled_ai_api_keycriticalAn AI key enters the client bundle via NEXT_PUBLIC_/VITE_/REACT_APP_
output-handlingeval_llm_outputcriticalModel output executed as code via eval()/Function()
output-handlingexec_llm_outputcriticalModel output passed to a shell command (command injection)
output-handlingllm_output_dangerously_set_inner_htmlhighModel output rendered as raw HTML (XSS)
output-handlingllm_json_no_validationmediumModel output JSON.parse'd without schema validation
excessive-agencyexcessive_agency_tool_namehighA tool that grants an agent shell/code execution
excessive-agencyunbounded_agent_loopmediumAn agent loop with no iteration bound (cost/DoS)
data-privacypii_field_in_llm_prompthighData like email/national ID/card number goes directly into a prompt
prompt-injectionunsanitized_input_in_system_promptmediumRaw request/user data mixed into a system prompt

These are heuristic findings — a static text-pattern scan, not a full AST analysis. Designed for a low false-positive rate, but every finding should still be reviewed manually.

Configuration (guardbee.yml)

yaml
ai-code-scanner:  fail-on: high       # any | critical | high | medium | low | none  max-files: 5000  rules-dir: .guardbee/rules   # custom rule packs, see below  exclude:    - ".test.ts"    - "fixtures/"

Custom rules

Built-in patterns cover common AI/LLM integration mistakes, but field names and internal conventions (e.g. which prop names carry KVKK-regulated data) are project-specific. Drop one or more JSON files into .guardbee/rules/ (configurable via rules-dir) and they're merged with the built-ins at scan time — for both the CLI and the MCP server (list_patterns marks them (custom)).

A file holds a single rule object or an array of them:

json
{  "id": "kvkk_musteri_tc_no",  "name": "musteriTcNo interpolated into a prompt",  "category": "data-privacy",  "pattern": "musteriTcNo",  "flags": "gi",  "severity": "high",  "recommendation": "Mask the national ID before it enters the prompt."}

category is one of client-exposure | output-handling | excessive-agency | data-privacy | prompt-injection | cost-control; severity is one of critical | high | medium | low. pattern is a JS regex source string (flags defaults to "g"). A rule id that collides with a built-in or another custom rule is rejected — the scanner keeps running but reports the problem on stderr and skips that entry.

Development

bash
npm run buildnpm test             # 36 unit tests

License

MIT — GuardBee

Feedback

Questions, ideas, or a false positive? Start a thread in GitHub Discussions or open an issue. If GuardBee is useful to you, a ⭐ on the repository helps others find it.

Source: packages/ai-code-scanner/README.md at commit bc5997d

Tools

4

scan_text

Scan a text string or code snippet for insecure AI/LLM integration patterns (client-exposed keys, unsafe output handling, excessive agent tool permissions, PII sent to a model, prompt injection surface).

Parameterslabelcontentrequired

scan_file

Scan a single file for insecure AI/LLM integration patterns

Parameterspathrequired

scan_directory

Recursively scan a directory for insecure AI/LLM integration patterns. Automatically skips node_modules, .git, dist, and binary files.

ParameterspathrequiredexcludeincludemaxFiles

list_patterns

List all AI/LLM security patterns that the scanner can detect, grouped by category (including any custom rules loaded from .guardbee/rules)

Takes no parameters.

Version history

3
  1. v0.5.1LatestOct 30, 2026
  2. v0.4.2Oct 22, 2026
  3. v0.3.3Oct 13, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts
  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts