sinewaveai/agent-security-scanner-mcp — Security scanner MCP server for AI coding agents.

Description and use

**Brief Summary**
sinewaveai/agent-security-scanner-mcp is an open‑source MCP (Model Context Protocol) server that protects AI coding agents from prompt‑injection attacks and package‑hallucination errors. It ships with a 4.3 M‑package hallucination database, more than 1 000 vulnerability rules powered by AST and taint analysis, and an auto‑fix engine, all exposed via a clean API/SDK/CLI.

**Value**
The project gives developers a turnkey security layer that can be dropped into any AI‑assistant workflow, turning raw LLM output into safe, verifiable actions. By standardising on MCP, teams can reuse the same scanner across multiple agents and tools, reducing duplicated security effort and enabling consistent policy enforcement (prompt‑injection firewall, dependency safety, code‑vulnerability checks).

**Practical Adoption Path**

1. **Prototype** – Pull the repository, run the provided Docker image or npm start script, and point your agent’s MCP client at the server’s endpoint.
2. **Integrate** – Replace the agent’s direct tool calls with MCP‑wrapped calls; the scanner will automatically inspect prompts, resolve package names against the 4.3 M‑entry database, and apply the AST/taint rules.
3. **Customize** – Extend the rule set or add organization‑specific policies via the JSON/YAML rule files or the SDK’s rule‑registration API.
4. **Deploy** – Containerise the server, configure TLS and authentication, and roll it out behind your internal gateway for production workloads.

**Production Readiness**

• **Activity & Adoption**: Recent commits (last update 2026‑05‑12), 100 ★, 10 forks, and active discussion in the MCP community indicate healthy momentum.
• **Technical Maturity**: Implemented in JavaScript with a well‑documented API, CLI, and SDK; supports auto‑fix and real‑time scanning, making it suitable for high‑throughput pipelines.
• **Risk Profile**: No critical metadata issues identified; the remaining checks (license compliance, formal security audit, maintainer commitment) are routine due‑diligence steps before a full production rollout.

Overall, the scanner is a strong OSS candidate for pilots and can be promoted to production once the final compliance review is completed.

Problem

sinewaveai/agent-security-scanner-mcp helps connect AI assistants to real tools and data through a standard protocol.

Outcome

High for an OSS candidate: recent activity, adoption, and ecosystem signals are strong enough for a serious pilot.

Workflow

• connect AI agents to tools
• ship Model Context Protocol servers
• standardize integrations

Evidence

Security scanner MCP server for AI coding agents. Prompt injection firewall, package hallucination detection (4.3M+ packages), 1000+ vulnerability rules with AST & taint analysis, auto-fix.

Source