AI Code Scanner

@guardbee/mcp-ai-code-scanner

🇬🇧 English | 🇹🇷 Türkçe | 🇨🇳 中文 | 🇯🇵 日本語 | 🇰🇷 한국어 | 🇧🇷 Português | 🇪🇸 Español | 🇩🇪 Deutsch

An MCP (Model Context Protocol) server that scans your codebase for security patterns commonly found in LLM/AI integrations.

While secret-scanner looks for leaked secrets/API keys, this package looks for patterns: how much a model's output is trusted, how privileged the tools it can call are, what data is sent to a third-party LLM — risks that a static credential scan can't catch.

Telemetry is off by default. With GUARDBEE_TELEMETRY=1 it sends the server, tool, success, duration and short parameter values such as a file path; longer strings and fields like content, token or password are replaced with a placeholder. See @guardbee/mcp-telemetry.

Claude ──► ai-code-scanner ──► Your codebase

│ ├─ Client-exposure (dangerouslyAllowBrowser: true) ├─ Output handling (eval(llmOutput), unvalidated JSON.parse) ├─ Excessive agency (an agent tool named execute_command) ├─ Data privacy (email/national ID interpolated directly into a prompt) └─ Prompt injection (raw request data mixed into a system prompt)

---

Features

• 10 patterns, 5 categories — client-exposure, output-handling, excessive-agency, data-privacy, prompt-injection
• Every finding includes why it's risky and what to do about it (recommendation) — not just "found it"
• SARIF 2.1.0 output — CI/CD integration (GitHub Code Scanning, etc.)
• Config file support via guardbee.yml
• Custom rule packs — extend detection with org-specific patterns (KVKK/GDPR field names, internal tool names) via JSON files, no fork required
• 36 unit tests — a positive and a negative (false-positive) scenario for every built-in pattern, plus custom-rule loading/validation

---

Quick Start

Claude Desktop / MCP Client

{

"mcpServers": { "guardbee-ai-code-scanner": { "command": "npx", "args": ["-y", "@guardbee/mcp-ai-code-scanner"] } } }

CLI (CI/CD)

npx @guardbee/mcp-ai-code-scanner scan ./src --fail-on=high --format=sarif > results.sarif

---

MCP Tools

---

Detected Patterns

These are heuristic findings — a static text-pattern scan, not a full AST analysis. Designed for a low false-positive rate, but every finding should still be reviewed manually.

---

Configuration (guardbee.yml)

ai-code-scanner:

fail-on: high # any | critical | high | medium | low | none max-files: 5000 rules-dir: .guardbee/rules # custom rule packs, see below exclude:

• ".test.ts"
• "fixtures/"

---

Custom rules

Built-in patterns cover common AI/LLM integration mistakes, but field names and internal conventions (e.g. which prop names carry KVKK-regulated data) are project-specific. Drop one or more JSON files into .guardbee/rules/ (configurable via rules-dir) and they're merged with the built-ins at scan time — for both the CLI and the MCP server (list_patterns marks them (custom)).

A file holds a single rule object or an array of them:

{

"id": "kvkk_musteri_tc_no", "name": "musteriTcNo interpolated into a prompt", "category": "data-privacy", "pattern": "musteriTcNo", "flags": "gi", "severity": "high", "recommendation": "Mask the national ID before it enters the prompt." }

category is one of client-exposure | output-handling | excessive-agency | data-privacy | prompt-injection | cost-control; severity is one of critical | high | medium | low. pattern is a JS regex source string (flags defaults to "g"). A rule id that collides with a built-in or another custom rule is rejected — the scanner keeps running but reports the problem on stderr and skips that entry.

---

Development

npm run build

npm test # 36 unit tests

---

License

MIT — GuardBee

Feedback

Questions, ideas, or a false positive? Start a thread in GitHub Discussions or open an issue. If GuardBee is useful to you, a ⭐ on the repository helps others find it.