Security scanner for vibe-coded projects: local CLI and MCP server that catch the security mistakes an AI coding assistant can silently introduce (hardcoded secrets, disabled RLS, open CORS, missing security headers) before you push.

LockZero language server — diagnostics and code actions for hardcoded secrets

Build-time security scanner for Vite projects - detect hardcoded secrets, RSC leaks, and dangerous patterns

A powerful and AI-driven CLI tool that automatically scans source code for hardcoded secrets before Git operations and deployments, helping developers prevent sensitive data leaks

See what your AI agents can access. Scans for installed AI coding agents, maps their MCP data sources, and flags hardcoded secrets.

Code Sentinel AST & AI Security Auditor CLI - Scan local repositories, SD cards, live URLs, and GitHub repos for security flaws and hardcoded secrets.

Antigravity skill and CLI to strip unnecessary comments, sanitize hardcoded secrets (Supabase, Firebase, OpenAI, Stripe) into .env, and enforce clean code across AI workflows.

Static security scanner for Model Context Protocol (MCP) servers. Detects tool-description poisoning, exfiltration cues, hidden-unicode payloads, arbitrary command execution, SSRF surface, hardcoded secrets, and rug-pull risk. Runs locally for Cursor and

ESLint plugin for Node.js API security — detects BOLA/IDOR, mass-assignment, SSRF, SQL injection, command injection, path traversal, open redirect, and hardcoded secrets across Express, Fastify, and NestJS.

An eslint rule that searches for potential secrets/keys in code

Fully automated Docker containerization for AI-generated projects. One command handles container setup, dependency installation, and security fixes. 24 features addressing 82% dependency conflicts, 60-70% environment mismatches, 48% hardcoded secrets in L

Keep your AI coding agent on a leash: a zero-config git hook that blocks reckless commits and force-pushes — huge diffs, deleted tests, hardcoded secrets, CI edits — before they land.

Lint .env files locally: sync against .env.example, validate syntax, detect hardcoded secrets (AWS, Stripe, GitHub, OpenAI, private keys…), and enforce an optional schema. Deterministic CLI, JSON/Markdown reports, no network — your secrets never leave the

Security scanning engine for Model Context Protocol (MCP) servers. Detects hardcoded secrets, command injection, SSRF, auth misconfig, and compliance gaps.

Hosted-first secrets vault client for AI agents — CLI, MCP server and SDK against the Hasna secrets API (credentials via @hasna/contracts), with an explicit opt-in on-box encrypted vault

Azure Key Vault Secrets

Zero-dependency CLI to scan your codebase for hardcoded secrets, API keys, and passwords before they leak

Security scanner for AI-generated code — finds hardcoded secrets, missing auth, data leaks, insecure configs

Free + offline post-quantum and weak-crypto scanner. Finds RSA / ECDSA / ECDH, hardcoded secrets, SHA-1 / MD5, TLS misconfig. Outputs a PDF + CycloneDX CBOM. No signup, no telemetry, Apache 2.0.

Local, zero-setup security linter for your MCP client configs. Catches command injection, hardcoded secrets, insecure transports, and known CVEs across Cursor, Claude, Windsurf, VSCode, Continue, Codex, and Zed. No account, no API calls, no data leaves yo