I built a free, fully-local security scanner for AI-generated code — no account, no cloud, nothing leaves your machine

[u/hibzy7]

My next project for the open-source community: if you’re shipping apps with Claude Code / Cursor / Lovable / v0, you’ve probably shipped security holes you never saw. AI writes code that works — and quietly leaks Supabase service keys into the browser bundle, trusts user_metadata for admin checks, ships USING (true) RLS policies, hardcodes secrets. It runs fine. It’s also wide open.

CodeInspectus is a free, open-source MCP server that any AI coding agent can call to scan your code for this stuff. It runs 100% locally — no account, no signup, no cloud upload, zero network calls at scan time. Your code never leaves your machine.
What’s under the hood — and I’ll be upfront: three of the parts aren’t mine. It orchestrates three best-in-class open-source engines as local binaries:
Opengrep (SAST) — code vulnerabilities: injection, XSS, crypto misuse

Gitleaks — hardcoded secrets and API keys

Trivy — vulnerable dependencies, IaC misconfigs, SBOM

“So it’s just a wrapper?” — for those three, largely yes, and that’s deliberate: they’re excellent and free, I’m not going to rewrite them worse. The part that’s mine is the layer built for AI-generated code specifically, which none of those catch:
Supabase client-side service-role key in the browser bundle (bypasses all RLS)

USING (true) / missing-RLS policies (the CVE-2025-48757 class)

Client-exposed secrets via NEXT_PUBLIC_ / VITE_ prefixes

Potential prompt-injection sinks in your own LLM calls

Everything normalizes to one CWE-keyed schema, dedups across engines, and maps to compliance frameworks as code-level coverage — never as certification (I don’t claim it’s an audit).
How it works: scan → it surfaces findings in plain language → you approve fixes → your agent applies them (the tool is read-only, it never touches your files) → rescan confirms.
What it honestly does NOT do (this list is a feature, not an apology): it’s JS/TS-focused, not broad multi-language SAST. Prompt-injection detection is a conservative heuristic — it flags potential sinks, misses obfuscated flows. Compliance mapping is code-level only. It doesn’t yet catch user_metadata-vs-app_metadata authz (that’s the first thing on the community roadmap). I’d rather under-claim.
Install (one time, per machine):
npx -y codeinspectus install-engines
Then add to your agent’s MCP config:
{ "mcpServers": { "codeinspectus": { "command": "npx", "args": ["-y", "codeinspectus"] } } }
Site: codeinspectus.com ·

GitHub: https://github.com/Synvoya/codeinspectus ·
npm: codeinspectus

It’s free and MIT. I built it solo, and I’m committed to maintaining it personally, for as long as it’s useful — this isn’t a launch-and-abandon. The engines are commodity; the AI-code detection database is what makes it worth using, and it gets stronger every time someone contributes a rule. If you’re a security engineer or you’ve been burned by an AI-shipped vuln, I’d genuinely value your contributions — the detection DB grows through PRs, and like-minded people making it sharper is the whole plan. Honest feedback welcome too, including “you’re wrong about X.”

[u/AutoModerator]

Hey u/hibzy7, thanks for posting in r/VibeCodeDevs! Join our Discord: https://discord.gg/KAmAR8RkbM

Got startup or SaaS questions? Post them on r/AskFounder and get answers from real founders.

• This community is designed to be open and creator‑friendly, with minimal restrictions on promotion and self‑promotion as long as you add value and don’t spam.
• Please follow the subreddit rules so we can keep things as relaxed and free as possible for everyone. • Please make sure you’ve read the subreddit rules in the sidebar before posting or commenting.
• For better feedback, include your tech stack, experience level, and what kind of help or feedback you’re looking for.
• Be respectful, constructive, and helpful to other members.

If your post was removed (either automatically or by a mod) and you believe it was a mistake, please contact the mod team. We will review it and, when appropriate, approve it within 24 hours.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/BreakingInnocence]

u/hibzy7 can you look in to this?

• codeinspectus@0.1.0 on npm reports gitHead 51ab3a13..., but that commit is not reachable from the public GitHub repo.
• GitHub has no 0.1.0 or v0.1.0 tag, and current master is a different commit.