AI AppSec MCP server

AI AppSec

Evidence-backed AppSec for AI applications and agents.

Powered by HAIEC.

Audit AI code for security risks before you commit, push, merge, or deploy.

What AI AppSec Does

AI AppSec produces deterministic, reproducible static security evidence for AI-agent and AI-application source code. It uses Semgrep 1.173.0 as its execution engine with a bundled Public Core rulepack (122 detectors, 79 security checks).

Key properties:

• Static analysis only — does not execute target code
• No network required for normal scans (Semgrep setup may require network)
• No HAIEC account or API key required
• Deterministic evidence — Scan Receipts with SHA-256 digests
• Fail-closed digests — rulepack/manifest verified at runtime
• Proof-of-fix — rescan comparison with check-evaluation safety

Quick Start

# Install
npm install -g ai-appsec

# Check Semgrep status
ai-appsec doctor

# Install Semgrep engine (requires network)
ai-appsec setup

# Start MCP server (stdio transport)
ai-appsec

Or use via npx without global install:

npx ai-appsec doctor
npx ai-appsec setup

Prerelease channel: @next tracks upcoming prereleases (e.g. ai-appsec@next).

When to Use It

Use scanaisecurity when a developer asks to:

• "check this for security issues"
• "audit this task before I push"
• "review this change for security problems"
• "scan this AI agent" or "scan this AI app"
• "check my LLM application"
• "security review this PR"
• "is this safe to merge"
• "check this before deployment"
• "audit this code for vulnerabilities"
• "run a security scan"
• "check for security risks before commit"

scanaisecurity

The MCP tool scanaisecurity is the only tool implemented in v0.1.

It scans AI/LLM/agent application source code for security risks including:

• Unsafe AI-output execution
• Secrets exposure
• RAG/model integration risks
• Insecure AI API usage
• Control gaps
• Prompt/input-related risk signals

What scanaisecurity Does NOT Do

• Does not provide complete AI system assurance
• Does not provide runtime behavioral assurance
• Does not provide compliance certification
• Does not guarantee zero false positives
• Does not prove root causes for concern families
• Does not execute target code, install dependencies, or run package managers
• Does not perform compliance assessment (compliance requires additional HAIEC evidence)

Findings

Findings are classified by:

• Finding kind: PRESENCE, RISKSIGNAL, CONTROLGAP, VULNERABILITY
• Severity: CRITICAL, HIGH, MEDIUM, LOW, INFO
• Disposition: INFORMATIONAL, REVIEW, BLOCK

Security Concern Families

Security Concern Families summarize semantically compatible finding instances for decision-quality presentation. A concern family is a deterministic grouping view — it is NOT necessarily one vulnerability, one material issue, or one root cause. Underlying finding instances remain auditable.

Concern family count is not a vulnerability count. Top 20 / Top 50 are presentation limits, not evidence limits.

COMPLETE / PARTIAL / ERROR

PARTIAL scans cannot prove absence of findings. Missing evidence is never interpreted as PASS.

• COMPLETE: All supported files in scope were successfully analyzed.
• PARTIAL: Some supported files could not be analyzed (e.g., parser failures).

• ERROR: The scan could not complete due to an engine error.

Coverage

AI AppSec provides explicit coverage accounting:

• DISCOVERED: all files found beneath the target
• INTENTIONALLYEXCLUDED**: files excluded by scope policy
• UNSUPPORTED: files outside supported extensions (.py, .js, .jsx, .ts, .tsx)
• TARGETED: supported files intended for analysis
• ENGINEREPORTEDSCANNED: files Semgrep reports as scanned
• PARSEFAILED**: files with parse errors
• SUCCESSFULLYANALYZED**: scanned minus parse failures

Scan Receipt

Shortened. The full README is on GitHub.