Synvoya/codeinspectus

What it does

Synvoya/codeinspectus is a security scanner specifically designed for AI-generated and hastily-written ("vibecoded") JavaScript and TypeScript code. It combines multiple industry-standard scanning tools—Opengrep, Gitleaks, and Trivy—behind a unified CWE-keyed schema while adding AI-specific security checks that traditional scanners miss.

Key features

• Detects client-side secret exposure and hardcoded credentials
• Identifies Supabase Row-Level Security (RLS) misconfigurations
• Flags prompt injection vulnerabilities
• Catches LLM output XSS sinks and other output-based attacks
• Zero-egress, local-first architecture with no telemetry collection
• No account required to use
• Unified CWE-keyed schema for consistent vulnerability classification

How to set up

As an MCP (Model Context Protocol) server, codeinspectus can be integrated with compatible AI platforms. Installation requires configuring the server endpoint in your MCP-compatible client (Claude, compatible AI studios, etc.) and providing local file paths or code snippets for scanning. Full setup instructions are available in the GitHub repository.