Arcwall Security

io.github.rom-baroPublished by GitHub account rom-barov1.0.1Updated Oct 24, 2026

Security scanning for AI coding tools. Detects secrets, threat models, and runs pre-commit checks.

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Arcwall Security scans code repositories, MCP configs and agent instruction files for secrets, vulnerabilities and prompt-injection risks from inside an AI…

What you can do
  • Scan code and repositories for hardcoded credentials and known CVEs in dependencies
  • Audit MCP configuration files and agent instruction files such as CLAUDE.md and .cursorrules for security issues
  • Generate STRIDE threat models for a project
  • Test prompts for prompt-injection weaknesses
  • Run a pre-commit security check before changes are committed
When to use it
Useful when you want an AI coding assistant to check a repository, MCP setup or agent instruction files for secrets and security problems without leaving the editor, and to run a security pass before committing.
Requirements
Runs locally over stdio via npx from the npm package @arcwall/mcp-server, so Node.js is needed. Requires an Arcwall API key supplied in the ARCWALL_API_KEY environment variable, obtained from the vendor's site. Desktop AI tools only; no web execution.
Before you install
The API key is a secret passed in the ARCWALL_API_KEY environment variable and should not be committed to config files that are shared. Scanning sends repository contents, configuration files and prompts to the vendor's service, so avoid running it on code you cannot share externally. The pre-commit check and scans read project files.

Installation

In SourceWeft

  1. Open Arcwall Security in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@arcwall/mcp-server

Security scanning for Claude Code, Cursor, Windsurf, and any MCP-compatible AI coding tool.

Setup

  1. Get your free API key at https://arcwall.io

  2. Add to your MCP config:

Claude Code (~/.claude/mcp.json):

json
{  "mcpServers": {    "arcwall": {      "command": "npx",      "args": ["@arcwall/mcp-server"],      "env": { "ARCWALL_API_KEY": "your-key-here" }    }  }}

Cursor (.cursor/mcp.json): Same config. Windsurf: Add via MCP settings panel.

  1. Restart your AI tool — Arcwall is ready.

Tools

  • arcwall_scan_secrets — hardcoded credentials
  • arcwall_scan_mcp — MCP config vulnerabilities
  • arcwall_scan_agent_instructions — CLAUDE.md, .cursorrules security
  • arcwall_threat_model — STRIDE analysis
  • arcwall_check_prompt — prompt injection testing
  • arcwall_pre_commit — pre-commit security check
  • arcwall_scan_dependencies — known CVEs in packages

Usage

Ask your AI assistant:

  • "Scan this repo for secrets"
  • "Check my MCP configs for vulnerabilities"
  • "Is my CLAUDE.md safe?"
  • "Generate a threat model for this project"
  • "Run a security check before I commit"
  • "Are there vulnerable packages in this project?"

Links

Source: README.md at commit 028e5ac

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.0.1LatestSep 16, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.