SafeWeave MCP server

SafeWeave

Security scanner for AI-written code. SafeWeave runs inside your AI editor over MCP (Claude Code, Cursor, VS Code, Windsurf) and checks your code for vulnerabilities, leaked secrets, risky dependencies, IaC and container issues, so your assistant can fix findings in the same turn.

• npm: safeweave-mcp
• Official MCP Registry: dev.safeweave/safeweave
• Website: safeweave.dev · try a scan without signing up at safeweave.dev/scan

This repository is the open-core part of SafeWeave: the scanner engines (packages/scanners), the scan gateway (packages/gateway), shared types (packages/common), Docker files and the Claude Code skill. The MCP server itself ships on npm.

Quick Start

Run one command. It downloads the scanners and configures every editor it finds:

npx -y safeweave-mcp

Or add it to your editor's MCP config yourself:

{
  "mcpServers": {
    "safeweave": {
      "command": "npx",
      "args": ["-y", "safeweave-mcp"],
      "env": {
        "SAFEWEAVE_LICENSE_KEY": "your-license-key-here"
      }
    }
  }
}

The key is optional. Without one you get a 10-scan trial (SAST, secrets and dependencies). A free account at safeweave.dev/signup unlocks unlimited local scans with 7 scanners.

Plans

See safeweave.dev/pricing for details.

Alternative: Docker

If you prefer running via Docker:

git clone https://github.com/nickfluxk/safeweave.git
cd safeweave
cp .env.example .env   # Edit with your license key and SCAN_DIR
docker compose up

How Scanner Binaries Work

SafeWeave automatically downloads and manages the scanner binaries it needs on first use.

• Binaries are resolved in order: system PATH → ~/.safeweave/bin/ cache → auto-download
• If you already have gitleaks or trivy installed via Homebrew/apt, those are used (never shadowed)
• For SAST, system semgrep is preferred; if not found, opengrep (a standalone Semgrep-compatible fork) is downloaded — no Python required
• Downloads happen in the background at startup — the server is ready immediately
• Versions are pinned and updated with each SafeWeave release
• If a download fails (no internet), that scanner is skipped gracefully

Supported platforms: macOS (arm64, x64), Linux (arm64, x64), Windows (x64)

Cache location:

~/.safeweave/
  bin/       # Downloaded binaries
  meta/      # Version metadata (JSON)

To force a re-download: rm -rf ~/.safeweave/bin ~/.safeweave/meta

What's Included

Shortened. The full README is on GitHub.