agent-security-scanner-mcp

概述

agent-security-scanner-mcp为AI编码代理和自主助手提供全面的安全扫描功能。它提供两个版本：轻量级ProofLayer扫描器（81.5KB，4秒安装）拥有400多个安全规则，以及完整的企业级版本，具有AST分析、污点跟踪和LLM驱动的语义代码审查功能。该扫描器包含检测漏洞、防止AI幻觉包、阻止提示注入攻击和生成合规报告的工具。它通过MCP与多个AI客户端集成，并为CI/CD管道提供CLI功能。

试试问 AI

装完之后，这里有 6 个你可以让 AI 做的事：

• scan_security

  Scan code for vulnerabilities (1700+ rules, 12 languages) with AST and taint analysis

  试试:Scan this code for security vulnerabilities试试:Check for security issues in my JavaScript file
• fix_security

  Auto-fix all detected vulnerabilities (120 fix templates)

  试试:Fix the security issues you found试试:Automatically resolve these vulnerabilities
• scan_git_diff

  Scan only changed files in git diff

  试试:Scan the changes for security issues试试:Check this diff for vulnerabilities
• scan_project

  Scan entire project with A-F security grading

  试试:Give my project a security grade试试:Audit the entire codebase for security
• check_package

  Verify a package name isn't AI-hallucinated (4.3M+ packages)

  试试:Is this package name real?试试:Check if this dependency exists
• scan_packages

  Bulk-check all imports in a file for hallucinated packages

  试试:Scan all imports in this file试试:Check these dependencies for hallucinations
• scan_agent_prompt

  Detect prompt injection with bypass hardening (59 rules + multi-encoding)

  试试:Check this prompt for injection attempts试试:Scan these instructions for manipulation
• scan_agent_action

  Pre-execution safety check for agent actions (bash, file ops, HTTP)

  试试:Is this command safe to execute?试试:Check this file operation for security risks
• scan_mcp_server

  Scan MCP server source for vulnerabilities: unicode poisoning, name spoofing

  试试:Analyze this MCP server for security issues试试:Scan this server for potential vulnerabilities
• scan_skill

  Deep security scan of an OpenClaw skill: prompt injection, AST+taint code analysis

  试试:Scan this OpenClaw skill for security issues试试:Check this skill for malicious code
• sbom_generate

  Generate CycloneDX v1.5 SBOM for a project

  试试:Generate a SBOM for this project试试:Create a bill of materials for my dependencies
• evaluate_compliance

  Evaluate project against compliance frameworks with evidence collection

  试试:Check this project for SOC2 compliance试试:Evaluate against GDPR technical requirements

可对比工具

安装

npm install -g agent-security-scanner-mcp

npm install -g @prooflayer/security-scanner

npx agent-security-scanner-mcp init claude-code

FAQ

这个扫描器支持哪些AI客户端？

该扫描器通过MCP集成支持Claude Code、Cursor、Windsurf、Cline、Claude Desktop、kilo-code、opencode和cody。它还提供独立CLI（OpenClaw）用于CI/CD管道。

它如何检测AI幻觉的包？

扫描器维护一个包含430万多个合法包的数据库，并使用布隆过滤器进行验证。检查导入时，它会将未在官方注册表中找到的任何标记为潜在的幻觉包。

agent-security-scanner-mcp 对比