<div align="center">

# 🛡️ AdaLab Scanner (`adalab-scanner`)
### Continuous Security Fuzzer & Verification Engine for Model Context Protocol (MCP)

[![AdaLab Verified](https://adalab.cc/api/badge/rexchou/adalab-scanner)](https://adalab.cc)
[![License: Apache-2.0](https://img.shields.io/badge/License-Apache--2.0-emerald.svg)](LICENSE)
[![npm version](https://img.shields.io/badge/npm-adalab--scanner-black.svg)](https://www.npmjs.com/package/adalab-scanner)

**[Web Platform](https://adalab.cc)** • **[MCP Directory](https://adalab.cc/directory)** • **[CI/CD Docs](https://adalab.cc/docs/github-action)**

</div>

---

## 📌 Overview

**AdaLab Scanner** is a zero-dependency security CLI and Model Context Protocol (MCP) server. Traditional linters miss AI-native failure modes like indirect prompt injections, tool parameter poisoning, and unconstrained subshell execution.

This package allows developers to locally audit codebases and run automated security gates in GitHub Actions.

---

## ⚡ Instant CLI Usage (Zero Install)

Run directly against your local MCP server repository:

```bash
npx adalab-scanner scan .
```

### What it checks:
1. **Tool Boundary Containment**: AST analysis for raw `child_process.exec`, `eval()`, and unsanitized subshells.
2. **Prompt Injection Vectors**: Detects unescaped string concatenations into agent system prompts.
3. **Secret & Key Bleed**: Flags hardcoded API keys (`sk-`, `ghp_`, cloud credentials).
4. **JSON-RPC Schema Conformance**: Validates `inputSchema` to prevent model parameter hallucinations.

---

## 🔌 Run as an MCP Server (Claude Desktop, Cursor, Cline)

AdaLab also runs as a native MCP server over stdio. Add to your `claude_desktop_config.json`:

```json
{
  "mcpServers": {
    "adalab": {
      "command": "npx",
      "args": ["-y", "adalab-scanner", "mcp"]
    }
  }
}
```

### Available MCP Tools:
- `scan_code_security`: Audit local files for prompt injection surfaces and shell escapes.
- `fuzz_prompt_injection`: Test system prompts against common jailbreak and injection payloads.
- `get_verification_badge`: Generate Shields.io-compatible markdown badges for your repo.

---

## 🚀 GitHub Actions CI/CD Gate

Add continuous security checking to your repository:

```yaml
name: AdaLab Security Gate

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run AdaLab Scanner
        run: npx adalab-scanner scan .
```

---

## 🏷️ Embed Verification Badge in README

Display live verification status on your project:

```markdown
[![AdaLab Verified](https://adalab.cc/api/badge/OWNER/REPO)](https://adalab.cc/audit/OWNER/REPO)
```

---

## 🔗 Cloud Platform & Enterprise Audit

For private repository analysis, SOC 2 compliance exports, and webhook notifications (Slack/Discord), visit [adalab.cc](https://adalab.cc).

License: [Apache-2.0](LICENSE)