Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@reprove run a full security audit on my app and apply only proven fixes"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Prove the exploit. Fix the app. Re-prove it.
Proof-carrying security for vibe-coded apps. Reprove finds the flaws AI app builders routinely ship — leaked keys, missing Supabase RLS, IDOR, injection, hallucinated dependencies — then proves each finding with a live exploit, generates a minimal patch, and re-runs the exploit to prove the fix.
A finding is real only if an exploit demonstrates it. (PROVEN)
A fix counts only if the exploit fails afterward and the app still builds.
Everything else is honestly labeled LIKELY, manual, or inconclusive —
never overstated.
MCP-native: the coding agent that generated your app can call Reprove in-loop and heal it.
Existing tools | Reprove |
Report possible issues from pattern matching | Report issues only after capturing live proof of exploitation |
Leave fix verification to the human | Re-runs the recorded exploit against the patched app; fix or it didn't happen |
Generic rules for enterprise codebases | Detectors for the exact failure modes of AI-generated apps (Supabase RLS, |
Need an LLM in the loop to feel smart | Deterministic-first: same input → same audit, offline-capable, no model in the critical path |
Rarely tested against clean code | Ships a hardened control corpus — precision is tested as hard as recall |
Related MCP server: novelty
git clone https://github.com/chaitu0608/reprove && cd reprove
python3 -m venv .venv && . .venv/bin/activate
pip install -e ".[mcp]" # mcp extra enables the MCP server
reprove demo # the full loop on the bundled vulnerable app
reprove scan path/to/your/app # static + live exploit proof
reprove audit path/to/your/app --apply # scan → patch → re-prove on a copy
reprove mcp # run as an MCP tool server (stdio)
reprove rules # list all analyzersOnly Python is required for the core (zero runtime dependencies). The dynamic exploit layer needs Node.js ≥ 20 to boot JavaScript/TypeScript apps.
$ reprove audit myapp --applyVERIFICATION — a fix counts only when it is proven
✅ verified `/api/admin/users` responds to anonymous callers
the recorded exploit no longer works against the patched app
proof: anonymous_access: GET http://127.0.0.1:52490/api/admin/users → 401
✅ verified IDOR confirmed: user B can read user A's data via GET /api/orders/o3
the recorded exploit no longer works against the patched app
proof: signup_a: POST .../api/auth/signup → 201
✅ verified Environment file committed to the repository: .env
re-scan no longer detects `secrets/committed-env` in .env
✅ verified SQL built by string concatenation
re-scan no longer detects `injection/sql-string-concat` in server.js
...
✋ manual Package `expres` closely resembles `express`
cannot be auto-verified (manual step required, e.g. key rotation)
fixes: 14 verified · 0 still vulnerable · 0 broke build · 2 manual · 0 inconclusiveBefore → after, from the recorded replay: the IDOR GET /api/orders/{id}
returns 404 for the wrong user, and the open admin route returns 401.
Not "patched" — proven patched, on a running instance of your app.
┌─────────────────────────────────────────────────────┐
your repo ──► │ 1. SCAN static analyzers (plugin registry) │
(or a copy) │ secrets · RLS · authz · IDOR · injection │
│ deps · config · AI-feature surfaces │
└──────────────────────────┬──────────────────────────┘
▼
┌─────────────────────────────────────────────────────┐
│ 2. PROVE boot app in an ephemeral sandbox │
│ two-user probe: create as A, fetch as B │
│ anonymous sweep over mined admin routes │
│ captured HTTP exchanges = evidence │
└──────────────────────────┬──────────────────────────┘
▼
┌─────────────────────────────────────────────────────┐
│ 3. PATCH deterministic template fixes only │
│ anything non-mechanical → `manual` │
│ with precise senior-engineer guidance │
└──────────────────────────┬──────────────────────────┘
▼
┌─────────────────────────────────────────────────────┐
│ 4. RE-PROVE build gate + exploit replay + rescan │
│ verified only if exploit fails AND build │
│ passes — otherwise it is reported as-is │
└─────────────────────────────────────────────────────┘Every exploit is a serialized spec (setup, steps, expected-vulnerable
signal, expected-fixed signal). Discovery and verification share the same
executor, so a "verified" fix means the identical attack failed on the patched
build. Evidence is kept: raw HTTP exchanges for proven findings, unified diffs
for patches. See docs/ARCHITECTURE.md for internals.
Analyzer | Catches |
| Hardcoded keys (OpenAI, Stripe, Supabase…), entropy hits, client-exposed vs repo-exposed classification, |
| Supabase tables with RLS disabled, permissive |
| Express/Next/node-http routes handling admin surfaces without an auth call |
|
|
| SQL built by string concatenation, XSS sinks, |
| Typosquat candidates (offline, edit-distance) + registry/OSV checks (online mode) |
| Wildcard CORS, stack traces shipped to clients, missing hardening |
| Client-side LLM keys, prompt-injection surface, model output reaching dangerous sinks |
reprove mcp speaks stdio MCP with 7 tools:
scan_project · list_findings · explain_finding · propose_patch ·
apply_patch (requires confirm) · verify_fix · full_audit
Example client config:
{
"mcpServers": {
"reprove": {
"command": "/absolute/path/to/.venv/bin/reprove",
"args": ["mcp"]
}
}
}Then, in your coding agent: "Use reprove to scan this project, explain the critical findings like I'm not a security engineer, fix the ones that are safe to automate, and prove the exploits no longer work."
Code | Meaning |
| clean — or nothing confirmed at |
| tool error |
| confirmed |
reprove scan . --json > audit.json # machine-readable, fails CI on confirmed highspytest tests/ -q # 10 tests: static rules, live IDOR/admin proof,
# clean-control zero-exploits, MCP tools,
# and the full prove→patch→re-prove loopThe repo ships an intentionally vulnerable app (corpus/vuln-node-api), a
hardened control (corpus/clean-node-api — must stay exploit-free), and a
static Next.js-like fixture. The control corpus is the point: a scanner that
finds everything in everything is noise.
Deliberately scoped in phases so every commit is shippable:
docs/ROADMAP.md · scaling design:
docs/SCALING.md.
Near-term: Docker-isolated sandbox, GitHub Action that comments verified fixes on PRs, tree-sitter/semgrep interop, live Supabase policy probing, PyPI release.
Reprove boots the target app locally and sends it exploit-shaped requests (two-user IDOR probes, anonymous sweeps). Use it only against code you own or are authorized to test. The bundled corpus apps are intended to be vulnerable — never deploy them. No probing escapes localhost in default configuration.
MIT — see LICENSE.
This server cannot be deployed
Zero-install security baseline for AI coding agents — OWASP/CWE-cited rules over MCP.
Security scanner for MCP servers. Detect vulnerabilities, prompt injection, and tool poisoning.
Zero-config MCP security scanner for AI-generated apps. 25K+ vulnerability patterns.
Lets coding agents check their own code for leaked secrets, risky dependencies and AI-code mistakes