CodeInspectus

CodeInspectus, by Synvoya

A local-first, privacy-preserving security MCP server and CLI. Any AI coding agent (Claude Code, Cursor, Codex, Windsurf, Cline, Aider) can invoke CodeInspectus to scan AI-generated / "vibe-coded" code for real vulnerabilities, map findings to compliance frameworks as honest code-level coverage, and drive a scan → fix → rescan loop — fully on your machine, with no account and zero network egress at scan time.

Reproduce the V2.1 proof: the codeinspectus@2.1.0 package scans an immutable public Rich commit, finds one high-confidence GitHub Actions expression-injection pattern, applies GitHub's documented intermediate-env remediation in a temporary clone, confirms it as 1 resolved, 0 remaining, 0 introduced, 0 not rechecked, then creates and verifies sealed evidence for both states. Run the reproduction script or read the scanner-derived case study. The recorded pre-publication run used the exact V2.1 tarball; the script defaults to npm after publication. The case uses the ai scanner class to isolate stable native behavior; use a normal full scan for broad repository coverage.

If CodeInspectus is useful, star the repository so other AI-app builders can find it.

CodeInspectus runs five engines behind one normalized, CWE-keyed schema: four best-in-class open-source engines, plus the Synvoya engine, our own, which carries the AI-code-specific checks and recent advisories that generic scanners miss:

• Opengrep — SAST / OWASP Top 10 (SARIF)
• Gitleaks — secrets
• Trivy — dependency CVEs (SCA), IaC misconfig, secrets, SBOM, and licence findings when you opt in (include_licenses: true / --licenses; off by default)
• osv-scanner (Google) — offline dependency matching against OSV.dev data, including OpenSSF malicious-package (MAL-) advisories. It runs only on the OSV databases you approved for the ecosystems your repository uses
• Synvoya engine (ours) — an offline gap-advisory layer for what those engines miss: declared Node.js, PHP, Python, Ruby, Go, .NET and Java versions (version-manager pins, manifests, CI setup steps, image tags), end-of-life lines, exploited products such as Adobe Commerce and WordPress core, malicious package versions, vendored and CDN-loaded JavaScript libraries (checked by osv-scanner through a per-scan SBOM), Magento editions, the declared Go toolchain, and GitHub Actions advisories. It reads only what the repository declares, ships inside the package with SHA-256 integrity checks, and folds into an upstream finding rather than duplicating it. Synvoya also provides the PHP and Node.js Opengrep rule packs (syn-php-*, syn-node-*). See docs/SYNVOYA.md
• CodeInspectus Pub — first-party, exact-version Dart/Flutter dependency matching and CycloneDX/SPDX inventory from pubspec.lock, backed by a bundled offline OSV Pub snapshot
• CodeInspectus native checks — client-side secret/bundle exposure, Supabase RLS / inverted-auth (the CVE-2025-48757 class), prompt-injection sinks, model-produced tool arguments reaching Node, Python, or narrowly supported Go, Java, C#, PHP, Rust, and Ruby shell sinks without a visible guard, general model output reaching JavaScript eval/Function or import-proven shell-string APIs, conventional Next.js and import-proven Express admin API handlers missing visible authentication or server-side authorization, Supabase Edge Functions with explicit anonymous deployment but no request authentication or privileged-operation authorization, client-writable user_metadata authorization, and unsanitized model/user output rendered via dangerouslySetInnerHTML (XSS / LLM05), plus explicit API-boundary leaks, raw request-to-database writes, sensitive logging, and evidence-gated security-header/CSP/Referrer-Policy/Permissions-Policy/session-cookie/Supabase-CAPTCHA configuration checks. Separate first-party packs cover six narrow Flutter/Dart source failure modes and eight bounded Android/iOS repository-configuration failures, plus four React Native and two Expo framework-specific mobile failures. A bounded Python AI/API pack covers ten narrow Django, Flask, FastAPI, Starlette, Jinja, OpenAI, Anthropic, LangChain, and OS-command source failures. Separate Go, Java, and C# AI packs each contribute one exact official OpenAI SDK tool-argument-to-shell rule; the PHP pack contributes one equivalent rule for the community-maintained openai-php/client ecosystem, and the Rust pack contributes one bounded rule for the community-maintained async-openai ecosystem. A Ruby pack contributes one equivalent rule for the exact official openai gem. A Firebase configuration pack contributes three literal public-write rules for Firestore, Cloud Storage, and Realtime Database. A GitHub Actions pack contributes two workflow rules for direct untrusted-context shell interpolation and exact pull_request_target checkout-and-execute chains.

The shipped manifest contains 126 curated detections: 72 first-party native rule IDs (29 JavaScript/TypeScript, 6 Flutter/Dart, 4 Android, 4 iOS, 4 React Native, and 2 Expo, plus 10 Python AI/API, 1 Go AI, 1 Java AI, 1 C# AI, 1 PHP AI, 1 Rust AI, 1 Ruby AI, 3 Firebase configuration, 2 GitHub Actions workflow, and 2 JavaScript baseline SAST rules), 18 Opengrep-owned SAST rules, 19 Synvoya PHP Opengrep rules (syn-php-*), 12 Synvoya Node.js Opengrep rules (syn-node-*), and 5 custom Gitleaks rules. All 20 ci-baseline-* Opengrep YAML rules remain physically active: the two native-owned rules reconcile exact results and fall back to Opengrep on mismatch or native unavailability. Opengrep, Gitleaks, Trivy, and osv-scanner are optional, managed, additive engines.

CodeInspectus explains each engine's coverage, license, platform-specific size, and required

action before asking permission. After approval it downloads the official, SHA-pinned

engine binaries, stores them outside the npm package, and calls

them as local subprocesses. It does not fork them.

Why CodeInspectus?

AI-generated apps often ship with security mistakes that generic scanners miss: exposed client-side secrets, weak Supabase auth patterns, unsafe HTML rendering, prompt-injection sinks, and risky AI/vector-store integrations.

CodeInspectus combines proven local scanners with AI-app-specific rules, then exposes the workflow through an MCP server so coding agents can scan, explain, and help fix issues before shipping.

Install

Prerequisite: Node.js ≥22. Node 24 LTS is recommended. No separate engine or Cosign installation is required. CodeInspectus can bootstrap a SHA-pinned Cosign verifier inside ~/.codeinspectus/ after approval; signature verification remains fail-closed. On Linux, the current upstream Opengrep assets require glibc. Alpine/musl remains supported for native CodeInspectus rules, Gitleaks, and Trivy, but setup marks Opengrep unavailable before any download and reports aggregate scan coverage as partial when it is selected.

The official @contentauth/c2pa-node validator is an optional peer because its upstream package downloads a platform-native binding during its own lifecycle script. Normal CodeInspectus installs do not install that peer. Install it explicitly alongside CodeInspectus when local C2PA validation is required; otherwise candidate assets report partial content_provenance coverage.

# Interactive: inspect coverage, licenses, and sizes; then approve all or choose components.

npx codeinspectus setup

Automation after an operator has reviewed the plan:

npx codeinspectus setup --status npx codeinspectus setup --all npx codeinspectus setup --select opengrep,gitleaks

osv-scanner: install it and download only the OSV databases this repository needs

(--path reads lockfile names to pick ecosystems; --osv-ecosystems names them explicitly).

npx codeinspectus setup --select osv-scanner --path /absolute/path/to/repository npx codeinspectus setup --select osv-scanner --osv-ecosystems npm,PyPI

On a terminal, a first bare npx codeinspectus run opens this guided setup. MCP clients continue to start over piped stdio and expose codeinspectus_setup: agents must request a plan, show it, ask permission, then call install with confirm_downloads=true. Declined choices are saved so users are not repeatedly prompted; setup --reset clears them.

Setup first checks local state without network access. It downloads only missing, mismatched, or newly pinned binaries, verifies them against the immutable lockfile shipped in the npm package, and atomically installs them under ~/.codeinspectus/. It refreshes the offline Trivy vulnerability DB only when it is missing, lacks rescan provenance, or is more than seven days old. Rule-only CodeInspectus upgrades therefore download nothing. After setup, scans perform zero network I/O.

osv-scanner's vulnerability data is one OSV database per package ecosystem. Setup downloads a database only after you approve it, only for the ecosystems your repository's lockfiles name (--path, or the path the MCP setup tool takes) or the ones you list with --osv-ecosystems, and only from osv-vulnerabilities.storage.googleapis.com. The allow-list is language ecosystems: npm, PyPI, Packagist, Go, crates.io, RubyGems, Maven, NuGet, and Pub, plus the small "GitHub Actions" database (about 100 KB, offered when the repository has workflows) that Synvoya's Actions matcher reads. Distribution ecosystems are never downloaded. The npm database is over 200 MB zipped, so setup shows each size before you approve. OSV publishes no signature for these files; integrity is TLS to that one host plus a SHA-256 CodeInspectus records at install time. Setup (unless you declined osv-scanner) and a bare repair-engines (while osv-scanner is installed) also refresh an OSV database you already installed once it is more than seven days old or has lost its install record; neither adds an ecosystem you did not approve. To add a database later: npx codeinspectus repair-engines osv-scanner --osv-ecosystems PyPI.

Every scan and codeinspectus_list_rules response includes structured engine_setup state: ready, repair_required, db_refresh_recommended, or unsupported_platform. MCP agents are instructed to explain non-ready state and obtain approval through codeinspectus_setup. There is no silent npm postinstall download. repair-engines remains available for advanced/manual use; the older install-engines command remains a compatibility alias.

If a Trivy DB was installed before 0.3.2, scan output tells your agent that CVE rescan tracking is not yet enabled. The agent should run setup (codeinspectus_setup, or `npx codeinspe