SafeWeave

SafeWeave

Security scanner for AI-written code. SafeWeave runs inside your AI editor over MCP (Claude Code, Cursor, VS Code, Windsurf) and checks your code for vulnerabilities, leaked secrets, risky dependencies, IaC and container issues, so your assistant can fix findings in the same turn.

• npm: safeweave-mcp
• Official MCP Registry: dev.safeweave/safeweave
• Website: safeweave.dev · try a scan without signing up at safeweave.dev/scan

This repository is the open-core part of SafeWeave: the scanner engines (packages/scanners), the scan gateway (packages/gateway), shared types (packages/common), Docker files and the Claude Code skill. The MCP server itself ships on npm.

Quick Start

Run one command. It downloads the scanners and configures every editor it finds:

npx -y safeweave-mcp

Or add it to your editor's MCP config yourself:

{

"mcpServers": { "safeweave": { "command": "npx", "args": ["-y", "safeweave-mcp"], "env": { "SAFEWEAVE_LICENSE_KEY": "your-license-key-here" } } } }

The key is optional. Without one you get a 10-scan trial (SAST, secrets and dependencies). A free account at safeweave.dev/signup unlocks unlimited local scans with 7 scanners.

Plans

See safeweave.dev/pricing for details.

Alternative: Docker

If you prefer running via Docker:

git clone https://github.com/nickfluxk/safeweave.git

cd safeweave cp .env.example .env # Edit with your license key and SCAN_DIR docker compose up

How Scanner Binaries Work

SafeWeave automatically downloads and manages the scanner binaries it needs on first use.

• Binaries are resolved in order: system PATH → `~/.safeweave/bin/` cache → auto-download
• If you already have gitleaks or trivy installed via Homebrew/apt, those are used (never shadowed)
• For SAST, system semgrep is preferred; if not found, opengrep (a standalone Semgrep-compatible fork) is downloaded — no Python required
• Downloads happen in the background at startup — the server is ready immediately
• Versions are pinned and updated with each SafeWeave release
• If a download fails (no internet), that scanner is skipped gracefully

Supported platforms: macOS (arm64, x64), Linux (arm64, x64), Windows (x64)

Cache location:

~/.safeweave/

bin/ # Downloaded binaries meta/ # Version metadata (JSON)

To force a re-download: rm -rf ~/.safeweave/bin ~/.safeweave/meta

What's Included

MCP Integration

Works with any MCP-compatible editor — Cursor, Claude Code, VS Code, Windsurf, and more.

Once configured (see Quick Start above), ask your AI:

• *"Scan this project for security vulnerabilities"*
• *"Check my dependencies for CVEs"*
• *"Scan for hardcoded secrets"*
• *"Run an IaC misconfiguration scan"*

If running via Docker, use the SSE transport instead:

{

"mcpServers": { "safeweave": { "url": "http://localhost:9000/sse" } } }

HTTP API

Health Check

curl http://localhost:9000/api/health

Run a Scan

curl -X POST http://localhost:9000/api/scan \

-H 'Content-Type: application/json' \ -d '{"directory": "/path/to/project"}'

Scan Specific Scanners

curl -X POST http://localhost:9000/api/scan \

-H 'Content-Type: application/json' \ -d '{"directory": "/path/to/project", "scanners": ["sast", "secrets"]}'

Compliance Profiles

Built-in profiles: standard, hardened, owasp, soc2, pci-dss, hipaa

Set via MCP set_profile tool or create a custom .safeweave/profile.yaml in your project.

Configuration

Environment Variables

Claude Code Skill: Auto-Scan Before Push

SafeWeave includes a Claude Code skill that automatically scans your code before every git commit, git push, or PR creation.

Install the skill

Copy the skill to your Claude Code skills directory:

mkdir -p ~/.claude/skills/secure-before-push

curl -sL https://raw.githubusercontent.com/nickfluxk/safeweave/main/skills/secure-before-push/SKILL.md \ -o ~/.claude/skills/secure-before-push/SKILL.md

Or clone and copy:

git clone https://github.com/nickfluxk/safeweave.git /tmp/safeweave

cp -r /tmp/safeweave/skills/secure-before-push ~/.claude/skills/

What happens after install

Once installed, Claude Code automatically runs a SafeWeave scan whenever you say "commit", "push", "ship it", or "create a PR":

Prerequisites

SafeWeave MCP server must be configured. Run npx safeweave-mcp to set it up automatically.

Verify

Start a new Claude Code session and ask it to commit code. You should see a SafeWeave scan run before the git operation.

License

MIT. See LICENSE.