# SafeWeave

Security scanner for AI-written code. SafeWeave runs inside your AI editor over MCP (Claude Code, Cursor, VS Code, Windsurf) and checks your code for vulnerabilities, leaked secrets, risky dependencies, IaC and container issues, so your assistant can fix findings in the same turn.

- **npm:** [`safeweave-mcp`](https://www.npmjs.com/package/safeweave-mcp)
- **Official MCP Registry:** `dev.safeweave/safeweave`
- **Website:** [safeweave.dev](https://safeweave.dev) · try a scan without signing up at [safeweave.dev/scan](https://safeweave.dev/scan)

This repository is the open-core part of SafeWeave: the scanner engines (`packages/scanners`), the scan gateway (`packages/gateway`), shared types (`packages/common`), Docker files and the Claude Code skill. The MCP server itself ships on npm.

## Quick Start

Run one command. It downloads the scanners and configures every editor it finds:

```bash
npx -y safeweave-mcp
```

Or add it to your editor's MCP config yourself:

```json
{
  "mcpServers": {
    "safeweave": {
      "command": "npx",
      "args": ["-y", "safeweave-mcp"],
      "env": {
        "SAFEWEAVE_LICENSE_KEY": "your-license-key-here"
      }
    }
  }
}
```

The key is optional. Without one you get a 10-scan trial (SAST, secrets and dependencies). A free account at [safeweave.dev/signup](https://safeweave.dev/signup) unlocks unlimited local scans with 7 scanners.

## Plans

| Plan | Price | Where scans run | Scanners |
|------|-------|-----------------|----------|
| No key | Free | Local, 10-scan trial | 3 (SAST, secrets, dependencies) |
| Free account | Free | Local | 7 (everything except DAST) |
| Cloud | $29/mo | Local + hosted | All 8, plus PR checks, website scans and AI-builder rules |
| Cloud Plus | $59/mo | Local + hosted | All of Cloud, plus teammates |

See [safeweave.dev/pricing](https://safeweave.dev/pricing) for details.

### Alternative: Docker

If you prefer running via Docker:

```bash
git clone https://github.com/nickfluxk/safeweave.git
cd safeweave
cp .env.example .env   # Edit with your license key and SCAN_DIR
docker compose up
```

## How Scanner Binaries Work

SafeWeave automatically downloads and manages the scanner binaries it needs on first use.

| Tool | Version | Purpose |
|------|---------|---------|
| [gitleaks](https://github.com/gitleaks/gitleaks) | 8.21.2 | Secret and credential detection |
| [trivy](https://github.com/aquasecurity/trivy) | 0.58.0 | Container vulnerability and IaC misconfiguration scanning |
| [opengrep](https://github.com/opengrep/opengrep) | 1.16.3 | SAST analysis (Semgrep-compatible, standalone binary) |

- Binaries are resolved in order: **system PATH** → **`~/.safeweave/bin/` cache** → **auto-download**
- If you already have `gitleaks` or `trivy` installed via Homebrew/apt, those are used (never shadowed)
- For SAST, system `semgrep` is preferred; if not found, `opengrep` (a standalone Semgrep-compatible fork) is downloaded — no Python required
- Downloads happen in the background at startup — the server is ready immediately
- Versions are pinned and updated with each SafeWeave release
- If a download fails (no internet), that scanner is skipped gracefully

**Supported platforms:** macOS (arm64, x64), Linux (arm64, x64), Windows (x64)

**Cache location:**

```
~/.safeweave/
  bin/       # Downloaded binaries
  meta/      # Version metadata (JSON)
```

To force a re-download: `rm -rf ~/.safeweave/bin ~/.safeweave/meta`

## What's Included

| Scanner | What it detects | Plan |
|---------|-----------------|------|
| **SAST** | SQL injection, XSS, SSRF, path traversal, insecure crypto | Free |
| **Secrets** | API keys, tokens, passwords and private keys in source | Free |
| **Dependencies** | Known CVEs in npm, pip, Go and Cargo packages | Free |
| **IaC** | Terraform, Dockerfile and Kubernetes misconfigurations | Free account |
| **Container** | Vulnerabilities in container images | Free account |
| **License** | GPL, AGPL and other risky dependency licenses | Free account |
| **Posture** | Missing auth, rate limiting, CORS and security headers | Free account |
| **DAST** | Runtime API security issues in a running app | Cloud |

## MCP Integration

Works with any MCP-compatible editor — Cursor, Claude Code, VS Code, Windsurf, and more.

Once configured (see Quick Start above), ask your AI:

- *"Scan this project for security vulnerabilities"*
- *"Check my dependencies for CVEs"*
- *"Scan for hardcoded secrets"*
- *"Run an IaC misconfiguration scan"*

If running via Docker, use the SSE transport instead:

```json
{
  "mcpServers": {
    "safeweave": {
      "url": "http://localhost:9000/sse"
    }
  }
}
```

## HTTP API

### Health Check
```bash
curl http://localhost:9000/api/health
```

### Run a Scan
```bash
curl -X POST http://localhost:9000/api/scan \
  -H 'Content-Type: application/json' \
  -d '{"directory": "/path/to/project"}'
```

### Scan Specific Scanners
```bash
curl -X POST http://localhost:9000/api/scan \
  -H 'Content-Type: application/json' \
  -d '{"directory": "/path/to/project", "scanners": ["sast", "secrets"]}'
```

## Compliance Profiles

Built-in profiles: `standard`, `hardened`, `owasp`, `soc2`, `pci-dss`, `hipaa`

Set via MCP `set_profile` tool or create a custom `.safeweave/profile.yaml` in your project.

## Configuration

### Environment Variables

| Variable | Required | Description |
|----------|----------|-------------|
| `SAFEWEAVE_LICENSE_KEY` | No | Your license key from [safeweave.dev](https://safeweave.dev). Without it: a 10-scan trial |
| `SCAN_DIR` | Docker only | Host directory to mount for scanning |
| `SAFEWEAVE_LICENSE_URL` | No | License server URL (defaults to `https://license.safeweave.dev`) |

## Claude Code Skill: Auto-Scan Before Push

SafeWeave includes a Claude Code skill that automatically scans your code before every `git commit`, `git push`, or PR creation.

### Install the skill

Copy the skill to your Claude Code skills directory:

```bash
mkdir -p ~/.claude/skills/secure-before-push
curl -sL https://raw.githubusercontent.com/nickfluxk/safeweave/main/skills/secure-before-push/SKILL.md \
  -o ~/.claude/skills/secure-before-push/SKILL.md
```

Or clone and copy:

```bash
git clone https://github.com/nickfluxk/safeweave.git /tmp/safeweave
cp -r /tmp/safeweave/skills/secure-before-push ~/.claude/skills/
```

### What happens after install

Once installed, Claude Code automatically runs a SafeWeave scan whenever you say "commit", "push", "ship it", or "create a PR":

| Severity | Action | Blocks push? |
|----------|--------|-------------|
| Critical / High | Fix immediately, re-scan | Yes |
| Medium | Warns, asks confirmation | User decides |
| Low / Info | No action | No |

### Prerequisites

SafeWeave MCP server must be configured. Run `npx safeweave-mcp` to set it up automatically.

### Verify

Start a new Claude Code session and ask it to commit code. You should see a SafeWeave scan run before the git operation.

## License

MIT. See [LICENSE](LICENSE).