Scans local Express apps for security issues such as wildcard CORS, string-built SQL, shell injection, and API routes that mutate data without an auth check.
Detects open Firebase security rules in the scanned project.
Scans local Next.js projects for common security problems, including secrets exposed to the browser through NEXT_PUBLIC_ variables, API routes that change data without a visible auth check, and dangerous code patterns such as dangerouslySetInnerHTML.
Flags Supabase tables without row-level security and leaked Supabase service_role JWTs found in the scanned project.
Scans local Vite projects for secrets exposed to the browser through VITE_ environment variables, alongside other leaked-secret and unsafe-code findings.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@repo-security-scan-mcp scan ./my-app for security issues before launch"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
An MCP server that lets Claude (or any MCP client) triage a local project for the classic security problems in AI-built web apps (Next.js, Vite, Express, Supabase, Firebase and similar).
It reads a folder you point it at. It never opens network connections and never probes live sites. Secrets in results are redacted to their first 4 characters.
Leaked secrets (AWS, Stripe, GitHub, OpenAI/Anthropic-style, Slack, SendGrid, private keys, database URLs with passwords, JWTs including Supabase service_role), secrets exposed to the browser through NEXT_PUBLIC_/VITE_ variables, Supabase tables without row-level security, open Firebase rules, wildcard CORS, dangerous code patterns (eval, dangerouslySetInnerHTML, string-built SQL, shell injection), API routes that change data without a visible auth check, weak JWT secrets, weak password hashing, debug mode left on, TLS verification turned off, committed .env files, unpinned dependencies, missing lockfile and missing tests.
Related MCP server: opzyai
Tool | What it does |
| Scans a folder; returns counts and findings ordered by severity ( |
| Same scan, returned as a short plain-English go/no-go with what to fix first. |
Requires Node 18+ and Python 3.
git clone <this repo> && cd repo-security-scan-mcp
npm install
npm testAdd to Claude Desktop (claude_desktop_config.json) or Claude Code (claude mcp add):
{ "mcpServers": { "repo-security-scan": { "command": "node", "args": ["/absolute/path/to/server.mjs"] } } }Set PYTHON if your Python executable is not python (Windows) or python3 (macOS/Linux).
Then ask: "Scan ./my-app and tell me what to fix before launch."
This is a heuristic static scan, not a penetration test. It produces false positives and misses issues. Review each finding before acting, and rotate any exposed secret immediately. npm test runs a real MCP client against generated fixture apps (fake secrets are assembled at runtime so this repo never contains token-shaped strings): 7 checks, including "clean app has 0 HIGH findings".
Open an issue or message the author.
License: MIT
This server cannot be deployed
Scan configs, files, or text for leaked secrets and obvious misconfigurations. Nothing stored.
Scan a deployed app URL for exposed keys, open Supabase tables and missing security headers.
Zero-config MCP security scanner for AI-generated apps. 25K+ vulnerability patterns.
Scan a site or AI-built app for exposed databases, keys and MCP endpoints, then verify the fixes.
