vetcode

A security check you can run before you trust code: your own app before it ships, or someone else's repo, package, extension or MCP server before you install it.

vetcode is an Agent Skill, an MCP server and a CLI, for Claude, Codex, Gemini, Copilot, Cursor and any other AI coding agent. A zero-dependency scanner finds candidates in seconds; then your agent reads the code around each one, traces where the data comes from, throws out false positives, and looks for what patterns cannot see (missing authorization, IDOR, broken business logic). You get a short report with real findings, concrete attack scenarios and fixes.

Free and open source (MIT), from the OpenYard community.

Tiếng Việt ở cuối trang ↓

What it checks

Related MCP server: llmsecurity-mcp

Install

vetcode comes in three forms; pick what your agent supports.

All of them need Node.js 18+.

Skill (any agent that loads Agent Skills)

With the skills CLI, which knows where each agent looks:

npx skills add openyard-cloud/vetcode

Or copy the folder yourself: git clone https://github.com/openyard-cloud/vetcode, then copy vetcode/skills/vetcode into your agent's skills folder: .agents/skills/ (the shared location many agents read, e.g. Codex and Copilot), .claude/skills/ (Claude Code), .github/skills/ (Copilot), .gemini/skills/ (Gemini CLI) or .cursor/skills/ (Cursor), in the project or under your home folder.

Claude Code plugin: run both lines; the first adds the marketplace, without it the second says Marketplace "openyard" not found.

/plugin marketplace add openyard-cloud/vetcode
/plugin install vetcode@openyard

claude.ai: download vetcode-skill.zip from Releases and upload it under Settings → Capabilities → Skills.

MCP server

The server runs npx straight from this repository, pinned to a release. It offers three tools (vetcode_scan, vetcode_guide, vetcode_reference) and a security_review prompt.

Most agents (.cursor/mcp.json, .mcp.json, Claude Desktop, Gemini CLI settings.json, Windsurf mcp_config.json):

{
  "mcpServers": {
    "vetcode": { "command": "npx", "args": ["-y", "-p", "github:openyard-cloud/vetcode#v0.2.0", "vetcode-mcp"] }
  }
}

VS Code (.vscode/mcp.json):

{ "servers": { "vetcode": { "type": "stdio", "command": "npx", "args": ["-y", "-p", "github:openyard-cloud/vetcode#v0.2.0", "vetcode-mcp"] } } }

Codex (~/.codex/config.toml):

[mcp_servers.vetcode]
command = "npx"
args = ["-y", "-p", "github:openyard-cloud/vetcode#v0.2.0", "vetcode-mcp"]

Then ask your agent to "use vetcode to review this project". The agent should call vetcode_guide once; the server also tells it to.

Agents that only read an instructions file

For tools that read AGENTS.md (or .cursorrules, CONVENTIONS.md…) but neither skills nor MCP, clone this repository next to your project and add:

## Security reviews
When asked to check code for security problems or malware, follow `../vetcode/skills/vetcode/SKILL.md`
and run its scanner: `node ../vetcode/skills/vetcode/scripts/vet.mjs <folder>`.

Use

Just ask:

• "Check this repo for malware before I run it"

• "Security review before I deploy"

• "Is this MCP server safe to install?"

• "Review my changes for security issues"

or run /vetcode in Claude Code (/vetcode:vetcode when installed as a plugin).

The scanner on its own

node skills/vetcode/scripts/vet.mjs [path] [options]

In CI

name: vetcode
on: [pull_request]
permissions:
  contents: read
  security-events: write
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/checkout@v4
        with: { repository: openyard-cloud/vetcode, path: .vetcode }
      - run: node .vetcode/skills/vetcode/scripts/vet.mjs . --sarif vetcode.sarif --fail-on high
      - uses: github/codeql-action/upload-sarif@v3
        if: always()
        with: { sarif_file: vetcode.sarif }

Suppressing a false positive

const id = Math.random(); // vetcode-ignore[insecure-random] used for a UI animation, not a secret

Name the rule. Folders can go in .vetcodeignore (gitignore syntax). Every report shows how much was suppressed, and --no-ignore turns all of it off.

How it works, and its limits

The scanner is regex and heuristics: fast, offline, explainable, and noisy on purpose. It produces candidates, not verdicts. The skill tells the agent to confirm each one with a concrete exploit scenario, drop what it cannot justify, and review what patterns cannot see. Cisco's measurements on malicious agent skills found that rules alone catch a small share of them, while adding a model's judgement catches far more; vetcode is built around that combination.

It is not a guarantee. New malware, logic bugs and infrastructure outside the repository can still slip through. Treat a clean report as "nothing obvious found".

Privacy: everything runs locally. Only with --online are package names and versions sent to OSV.dev. Secrets are redacted in every report.

Learning from others

vetcode borrows ideas (not code) from projects that do parts of this very well, and works alongside them: GuardDog, zizmor, gitleaks, trufflehog, Snyk agent-scan (mcp-scan), OpenSSF malicious-packages, semgrep, claude-code-security-review and Trail of Bits' skills. If you need deep coverage in one area, use them too; vetcode will pick up gitleaks, semgrep, osv-scanner and trivy when they are installed.

Contributing

New rules, fewer false positives and real-world samples are all welcome. See CONTRIBUTING.md. Found a way to make vetcode miss malware? Please report it privately: SECURITY.md.

Tiếng Việt

vetcode là công cụ kiểm tra bảo mật cho các AI agent lập trình (Claude, Codex, Gemini, Copilot, Cursor…). Dùng nó để soát app, web, server của bạn trước khi deploy, hoặc soát repo, package, extension, MCP server của người khác trước khi cài.

• Cách hoạt động: bộ quét (không cần cài gì thêm) tìm các điểm đáng ngờ trong vài giây. Sau đó Claude đọc code quanh từng điểm, lần theo dữ liệu, loại báo động giả, và tìm thêm lỗi mà regex không thấy được như thiếu phân quyền, IDOR hay sai logic nghiệp vụ.

• Kiểm tra: mã độc, tấn công chuỗi cung ứng (package giả tên, script cài đặt độc), lỗ hổng nhắm vào AI agent (hooks, chỉ dẫn ẩn trong CLAUDE.md, MCP độc), lộ key và secret, lỗ hổng web/API, cấu hình server và cloud (Docker, nginx, Supabase RLS, Firebase, Cloudflare), CI/CD.

• Dùng được với nhiều agent: Claude, Codex, Gemini CLI, GitHub Copilot, Cursor, Windsurf…, dưới dạng skill (npx skills add openyard-cloud/vetcode), MCP server, hoặc dòng lệnh. Xem phần Install ở trên.

• Cài cho Claude Code: chạy lần lượt /plugin marketplace add openyard-cloud/vetcode rồi /plugin install vetcode@openyard. Thiếu lệnh đầu sẽ báo Marketplace "openyard" not found.

• Dùng: hỏi bằng tiếng Việt, ví dụ "kiểm tra bảo mật repo này", "quét mã độc trước khi cài", "soát lỗ hổng trước khi deploy". Báo cáo sẽ trả lời bằng tiếng Việt.

• Riêng tư: mọi thứ chạy trên máy bạn. Chỉ khi bật --online thì tên và phiên bản package mới được gửi tới OSV.dev. Secret luôn được che trong báo cáo.

Miễn phí, mã nguồn mở (MIT), thuộc cộng đồng OpenYard.