Husk MCP server

A local-first security scanner for developers. One binary, no account.

Install · Quickstart · Usage · Commands · How it works

husk scans your machine for compromised packages, leaked secrets, risky install scripts, and unsafe AI/MCP configuration, then shows you what to fix. It runs locally: no login, no account, no file ever leaves your machine. An online scan sends only package names, versions, and CVE ids to public advisory databases (OSV.dev, npm, PyPI, GitHub, CISA KEV / FIRST EPSS); --offline makes zero network calls.

Pre-1.0 software without an independent audit. Interfaces can change

between releases. Bug reports and questions are welcome in

Issues.

Install

husk runs on Linux and macOS. On Windows, run it inside WSL, where it installs and behaves exactly as it does on Linux. There is no native Windows build.

Download the latest signed release, verify its checksum, and install it:

curl -fsSL https://husk-security.dev/install.sh | sh

It installs to ~/.local/bin, overridable with HUSKINSTALLDIR or --install-dir. If that directory is not already on your PATH, it asks before adding it to your shell's startup file and names the exact file it would change. Decline, or run it without a terminal, and it prints the one command that adds it instead. --no-modify-path never writes to a startup file at all.

Prefer not to pipe into a shell? Download install.sh, read it, then run it. Every release is cosign-signed and SLSA-attested; the installer verifies the SHA-256 checksum (and the signature too, when cosign is on your PATH). See verifying a release.

Other install sources

| Source | Command |

| --- | --- |

| cargo | cargo install husk-sec |

| cargo-binstall | cargo binstall husk-sec |

| npm | npm install -g husk-sec |

Nix

Run it without installing anything:

sh

nix run github:husk-security/husk -- scan

The flake exposes two packages: husk (the default, with the localhost web

UI) and husk-tui (the same binary without it, so it needs no Node

toolchain).

For persistent use, add the flake as an input and put the package in your

configuration. NixOS:

nix

{

inputs.husk.url = "github:husk-security/husk";

inputs.husk.inputs.nixpkgs.follows = "nixpkgs";

outputs = { nixpkgs, husk, ... }: {

nixosConfigurations.myhost = nixpkgs.lib.nixosSystem {

system = "x86_64-linux";

modules = [

{ environment.systemPackages = [ husk.packages.x86_64-linux.husk ]; }

];

};

};

}

Home Manager, with the same input:

nix

home.packages = [ husk.packages.x86_64-linux.husk ];

If you would rather put it on PATH imperatively than declare it,

nix profile install github:husk-security/husk also works.

Quickstart

husk            # print help (no subcommand does nothing else)
husk scan       # one-shot scan of the current directory, plain terminal summary
husk web        # serve the local web UI and open it in your browser
husk tui        # browse the latest scan in the terminal UI

Shortened. The full README is on GitHub.