{"_id":"@rupeshpanwar/security-scanner-mcp","_rev":"3-c3e22192b8dfa8fd1ca45f2918705280","name":"@rupeshpanwar/security-scanner-mcp","dist-tags":{"latest":"1.1.1"},"versions":{"1.0.0":{"name":"@rupeshpanwar/security-scanner-mcp","version":"1.0.0","keywords":["mcp","security","scanner","vulnerability","secrets","git","audit"],"author":{"name":"Rupesh Panwar"},"license":"MIT","_id":"@rupeshpanwar/security-scanner-mcp@1.0.0","maintainers":[{"name":"rupeshpanwar","email":"rupesh.panwwar@gmail.com"}],"homepage":"https://github.com/Rupeebw/security-scanner-mcp#readme","bugs":{"url":"https://github.com/Rupeebw/security-scanner-mcp/issues"},"bin":{"security-scanner-mcp":"dist/index.js"},"dist":{"shasum":"53ece3c0410c0fe361cfe458e66728ffc167e2c9","tarball":"https://registry.npmjs.org/@rupeshpanwar/security-scanner-mcp/-/security-scanner-mcp-1.0.0.tgz","fileCount":11,"integrity":"sha512-M39Yjce+ZxYFchI30g4azuJ7A/nKDBxSidOLtJjQq5BdLUE8eCxEvoRJmO7kkGfAhJ9yK2FDr/Yqokzrtch0mg==","signatures":[{"sig":"MEUCIQCLxmVBcpDnLqhe/ZNv8z+14nPYHBBbtwLMwB6U8y4EhAIgWDXnF1EBsCjkVZPmiWmia9Kf3RhObtDRucAnlyBy3XY=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":62075},"type":"module","engines":{"node":">=18.0.0"},"gitHead":"2ffb8dd02284f9278896ff5dbd86672bd48d78f5","scripts":{"dev":"tsx src/index.ts","test":"jest","build":"tsc && node scripts/copy-patterns.js"},"_npmUser":{"name":"rupeshpanwar","email":"rupesh.panwwar@gmail.com"},"repository":{"url":"git+https://github.com/Rupeebw/security-scanner-mcp.git","type":"git"},"_npmVersion":"11.3.0","description":"MCP server for comprehensive security scanning of code repositories","directories":{},"_nodeVersion":"24.2.0","dependencies":{"zod":"^3.22.0","glob":"^10.3.10","ignore":"^5.3.0","@modelcontextprotocol/sdk":"^0.5.0"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.6.2","jest":"^29.7.0","ts-jest":"^29.1.1","typescript":"^5.3.0","@types/glob":"^8.1.0","@types/node":"^20.0.0"},"_npmOperationalInternal":{"tmp":"tmp/security-scanner-mcp_1.0.0_1754586421483_0.731428566577879","host":"s3://npm-registry-packages-npm-production"}},"1.1.0":{"name":"@rupeshpanwar/security-scanner-mcp","version":"1.1.0","keywords":["mcp","security","scanner","vulnerability","secrets","git","audit"],"author":{"name":"Rupesh Panwar"},"license":"MIT","_id":"@rupeshpanwar/security-scanner-mcp@1.1.0","maintainers":[{"name":"rupeshpanwar","email":"rupesh.panwwar@gmail.com"}],"homepage":"https://github.com/Rupeebw/security-scanner-mcp#readme","bugs":{"url":"https://github.com/Rupeebw/security-scanner-mcp/issues"},"bin":{"security-scan":"cli.js","security-scanner-mcp":"dist/index.js"},"dist":{"shasum":"ca88043a5f119385a98493446d49f63bea00a123","tarball":"https://registry.npmjs.org/@rupeshpanwar/security-scanner-mcp/-/security-scanner-mcp-1.1.0.tgz","fileCount":12,"integrity":"sha512-sQPMQloNp9lQRmcVeLnVxtPGtr2unN0d8iCK6XLRHWj8QQvuIWw48tlHdcNeNBcKNBYkT4HHwOXdNW+dTUzTzA==","signatures":[{"sig":"MEQCIGHWAa+kw9sVityRI7HemAiJr4LuRwYkHdfAyl1gdvLHAiB8bK01q8Te+7pEOZGRDpKNSTbLdvq6JRX9cuGoiKh/vw==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":64896},"type":"module","engines":{"node":">=18.0.0"},"gitHead":"2ffb8dd02284f9278896ff5dbd86672bd48d78f5","scripts":{"dev":"tsx src/index.ts","test":"jest","build":"tsc && node scripts/copy-patterns.js"},"_npmUser":{"name":"rupeshpanwar","email":"rupesh.panwwar@gmail.com"},"repository":{"url":"git+https://github.com/Rupeebw/security-scanner-mcp.git","type":"git"},"_npmVersion":"11.3.0","description":"MCP server for comprehensive security scanning of code repositories","directories":{},"_nodeVersion":"24.2.0","dependencies":{"zod":"^3.22.0","glob":"^10.3.10","chalk":"^5.3.0","ignore":"^5.3.0","commander":"^11.1.0","@modelcontextprotocol/sdk":"^0.5.0"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.6.2","jest":"^29.7.0","ts-jest":"^29.1.1","typescript":"^5.3.0","@types/glob":"^8.1.0","@types/node":"^20.0.0"},"_npmOperationalInternal":{"tmp":"tmp/security-scanner-mcp_1.1.0_1754588579557_0.9058778541291097","host":"s3://npm-registry-packages-npm-production"}},"1.1.1":{"name":"@rupeshpanwar/security-scanner-mcp","version":"1.1.1","description":"MCP server for comprehensive security scanning of code repositories","keywords":["mcp","security","scanner","vulnerability","secrets","git","audit"],"author":{"name":"Rupesh Panwar"},"license":"MIT","type":"module","bin":{"security-scanner-mcp":"dist/index.js","security-scan":"cli.js"},"scripts":{"build":"tsc && node scripts/copy-patterns.js","dev":"tsx src/index.ts","test":"jest"},"repository":{"type":"git","url":"git+https://github.com/Rupeebw/security-scanner-mcp.git"},"bugs":{"url":"https://github.com/Rupeebw/security-scanner-mcp/issues"},"homepage":"https://github.com/Rupeebw/security-scanner-mcp#readme","engines":{"node":">=18.0.0"},"dependencies":{"@modelcontextprotocol/sdk":"^0.5.0","chalk":"^5.3.0","commander":"^11.1.0","glob":"^10.3.10","ignore":"^5.3.0","zod":"^3.22.0"},"devDependencies":{"@types/glob":"^8.1.0","@types/node":"^20.0.0","jest":"^29.7.0","ts-jest":"^29.1.1","tsx":"^4.6.2","typescript":"^5.3.0"},"_id":"@rupeshpanwar/security-scanner-mcp@1.1.1","gitHead":"6f2f11a1f99d93f7c52ada4291c052e3df6c06b5","_nodeVersion":"24.2.0","_npmVersion":"11.3.0","dist":{"integrity":"sha512-pcquXw97FJX9TeihjSmyGqBK4Psx/5xq1dr83fHdE9IwtG6bi3C1GZFuSDFyGL/s23phmoJts9N3XjOmJfSTPA==","shasum":"15c4adda8ff8f59859baf4f8c968d38b5a0e475d","tarball":"https://registry.npmjs.org/@rupeshpanwar/security-scanner-mcp/-/security-scanner-mcp-1.1.1.tgz","fileCount":12,"unpackedSize":64896,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEQCICOwXUz227hBrWFkgoBYT9V+6RZRNwxvUg/BJuioAUb6AiBH39RH3f8oGVIXk7X2x3paD28Wv4IbbWvooekQtIg9SA=="}]},"_npmUser":{"name":"rupeshpanwar","email":"rupesh.panwwar@gmail.com"},"directories":{},"maintainers":[{"name":"rupeshpanwar","email":"rupesh.panwwar@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/security-scanner-mcp_1.1.1_1754589079987_0.5274511262752228"},"_hasShrinkwrap":false}},"time":{"created":"2025-08-07T17:07:01.360Z","modified":"2025-08-07T17:51:20.369Z","1.0.0":"2025-08-07T17:07:01.729Z","1.1.0":"2025-08-07T17:42:59.724Z","1.1.1":"2025-08-07T17:51:20.173Z"},"bugs":{"url":"https://github.com/Rupeebw/security-scanner-mcp/issues"},"author":{"name":"Rupesh Panwar"},"license":"MIT","homepage":"https://github.com/Rupeebw/security-scanner-mcp#readme","keywords":["mcp","security","scanner","vulnerability","secrets","git","audit"],"repository":{"type":"git","url":"git+https://github.com/Rupeebw/security-scanner-mcp.git"},"description":"MCP server for comprehensive security scanning of code repositories","maintainers":[{"name":"rupeshpanwar","email":"rupesh.panwwar@gmail.com"}],"readme":"# Security Scanner MCP Server\n\nA comprehensive security scanning tool for code repositories, exposed as an MCP (Model Context Protocol) server. This tool helps developers identify security vulnerabilities, exposed secrets, dependency issues, and configuration problems in their codebases.\n\n## Features\n\n- **Secret Detection**: Scans for exposed API keys, passwords, tokens, and other sensitive information\n- **Vulnerability Analysis**: Identifies common security vulnerabilities in code\n- **Dependency Auditing**: Checks for outdated or vulnerable dependencies\n- **Git Security**: Analyzes .gitignore files and git history for security issues\n- **Real-time Scanning**: Check content for secrets before committing\n- **Security Best Practices**: Provides actionable security recommendations\n\n## Installation\n\n```bash\nnpm install -g @rupeshpanwar/security-scanner-mcp\n```\n\nOr use with `npx`:\n\n```bash\nnpx @rupeshpanwar/security-scanner-mcp\n```\n\n## CLI Usage (NEW in v1.1.0)\n\nThe package now includes a standalone CLI tool for direct command-line scanning:\n\n```bash\n# Scan a directory with summary output\nsecurity-scan scan /path/to/project\n\n# Scan with detailed output\nsecurity-scan scan /path/to/project --format detailed\n\n# Scan specific categories\nsecurity-scan scan /path/to/project --categories secrets vulnerabilities\n\n# Output as JSON\nsecurity-scan scan /path/to/project --format json\n\n# Save report to file\nsecurity-scan scan /path/to/project --format detailed > security-report.txt\n```\n\n### CLI Options:\n- `--format <format>`: Output format (summary|detailed|json), default: summary\n- `--categories <categories...>`: Specific categories to scan (secrets|vulnerabilities|dependencies|gitignore|git-history), default: all\n\n## Usage with Claude Desktop\n\nAdd the server to your Claude Desktop configuration:\n\n### macOS\nEdit `~/Library/Application Support/Claude/claude_desktop_config.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"security-scanner\": {\n      \"command\": \"npx\",\n      \"args\": [\"@rupeshpanwar/security-scanner-mcp\"]\n    }\n  }\n}\n```\n\n### Windows\nEdit `%APPDATA%\\Claude\\claude_desktop_config.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"security-scanner\": {\n      \"command\": \"npx\",\n      \"args\": [\"@rupeshpanwar/security-scanner-mcp\"]\n    }\n  }\n}\n```\n\n## Available Tools\n\n### 1. scan_repository\nPerforms a comprehensive security scan on a repository.\n\n**Parameters:**\n- `path` (required): Path to the repository to scan\n- `outputFormat` (optional): Output format - \"summary\", \"detailed\", or \"json\" (default: \"summary\")\n- `categories` (optional): Specific categories to scan (default: all)\n  - \"secrets\": API keys, passwords, tokens\n  - \"vulnerabilities\": Code vulnerabilities\n  - \"dependencies\": Dependency issues\n  - \"gitignore\": .gitignore analysis\n  - \"git-history\": Git history scanning\n\n**Example:**\n```\nScan the repository at /path/to/repo for all security issues\n```\n\n### 2. check_secret\nChecks if a piece of content contains potential secrets or sensitive information.\n\n**Parameters:**\n- `content` (required): Content to check for secrets\n- `fileType` (optional): File type/extension for context-aware scanning\n\n**Example:**\n```\nCheck this content for secrets: AWS_ACCESS_KEY=AKIA1234567890ABCDEF\n```\n\n### 3. check_gitignore\nAnalyzes .gitignore file for missing security patterns.\n\n**Parameters:**\n- `path` (required): Path to the repository\n- `patterns` (optional): Additional patterns to check for\n\n**Example:**\n```\nCheck if the .gitignore in /path/to/repo has all recommended security patterns\n```\n\n### 4. get_security_tips\nGet security best practices and tips for a specific topic.\n\n**Parameters:**\n- `topic` (required): Security topic\n  - \"secrets\": Secret management best practices\n  - \"gitignore\": .gitignore recommendations\n  - \"dependencies\": Dependency security\n  - \"docker\": Docker security\n  - \"ci-cd\": CI/CD security\n  - \"general\": General security tips\n\n**Example:**\n```\nGive me security tips about secrets management\n```\n\n## Security Patterns Detected\n\n### Secrets\n- AWS Access Keys and Secret Keys\n- API Keys (OpenAI, Google, GitHub, etc.)\n- Private Keys (SSH, SSL certificates)\n- Database connection strings\n- OAuth tokens\n- JWT tokens\n- And many more...\n\n### Vulnerabilities\n- SQL injection risks\n- Command injection risks\n- Hardcoded IPs and credentials\n- Weak cryptography usage\n- Insecure deserialization\n- Debug code in production\n- Insecure random number generation\n\n### Configuration Issues\n- Missing .gitignore patterns\n- Exposed configuration files\n- Temporary file usage\n- HTTP without TLS\n\n## Example Workflow\n\n1. **Initial Repository Scan**\n   ```\n   Scan the repository at ./my-project and show me a detailed report\n   ```\n\n2. **Check Code Before Committing**\n   ```\n   Check this config file for any secrets:\n   [paste your config content]\n   ```\n\n3. **Fix .gitignore Issues**\n   ```\n   Check my .gitignore file and tell me what security patterns I'm missing\n   ```\n\n4. **Get Security Recommendations**\n   ```\n   Give me best practices for managing secrets in my codebase\n   ```\n\n## Output Formats\n\n### Summary Format\nQuick overview showing count of issues by severity level.\n\n### Detailed Format\nComplete listing of all findings with:\n- Issue description\n- File location and line number\n- Severity level\n- Remediation recommendations\n\n### JSON Format\nMachine-readable format for integration with other tools.\n\n## Best Practices\n\n1. **Run Regular Scans**: Integrate into your CI/CD pipeline\n2. **Fix Critical Issues First**: Address high and critical severity findings immediately\n3. **Update .gitignore**: Ensure all sensitive file patterns are excluded\n4. **Rotate Exposed Secrets**: If any secrets are found, rotate them immediately\n5. **Keep Dependencies Updated**: Regular dependency updates reduce vulnerabilities\n\n## Contributing\n\nContributions are welcome! Please feel free to submit a Pull Request.\n\n## License\n\nMIT\n\n## Acknowledgments\n\nThis tool was created after discovering exposed credentials in production code. It aims to help developers prevent similar security incidents by providing proactive scanning and education about security best practices.","readmeFilename":"README.md"}