AI Code Scanner runs on your own machine — the client starts it, so there is no endpoint to ping. 43 installs a week from npm. Last commit 11 Oct 2026.
Scans code for insecure LLM/AI integration: exposed keys, unsafe output, prompt injection
What the code does
We read the source, 5 h ago · rules ccca72095570
What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.
const result = spawnSync(process.execPath, [cliPath, entry.cmd, ...args], {
pattern: /\b(?:read|cat|include|attach|append)\b[^.]{0,80}(?:\.ssh\b|\bid_rsa\b|\.env\b|\.aws[\\/]credentials\b|\bprivate[\s_-]?key\b|\.npmrc\b)/i,
Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.
This code can reach further than it looks
We found places where it runs commands, builds paths or queries from values it is given. None of that is a flaw by itself — it becomes one when the code changes, and code changes quietly between releases. We re-read it on every one.
Connect this server
This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.
claude mcp add ai-code-scanner -- npx -y @guardbee/mcp-ai-code-scanner{
"mcpServers": {
"ai-code-scanner": {
"args": [
"-y",
"@guardbee/mcp-ai-code-scanner"
],
"command": "npx"
}
}
}[mcp_servers.ai-code-scanner]
command = "npx"
args = ["-y", "@guardbee/mcp-ai-code-scanner"]{
"mcpServers": {
"ai-code-scanner": {
"args": [
"-y",
"@guardbee/mcp-ai-code-scanner"
],
"command": "npx"
}
}
}{
"mcpServers": {
"ai-code-scanner": {
"args": [
"-y",
"@guardbee/mcp-ai-code-scanner"
],
"command": "npx"
}
}
}Alternatives to AI Code Scanner
same job, measured the same waySecurity scan for AI-generated code: injection, SSRF, secrets, weak crypto, unsafe deserialization.
AI security layer: code scanning, PII detection, prompt injection, secrets, CVEs
Scan GitHub-hosted AI skills for vulnerabilities: prompt injection, malware, OWASP LLM Top 10.
Scan pasted Stripe webhook/checkout code for common integration bugs.
Detect prompt injection, jailbreaks, and code injection in untrusted text before it reaches an LLM.
Scan codebases for LLM/AI SDK usage, exposed API tokens, and hardcoded secrets.
Scans code changes for leaked secrets and insecure config, with actionable fixes for AI agents.
Local-first PHI detection for source code, LLM prompts, logs, and analytics
AI Code Scanner — questions
Answers built from our own checks of this server.