Scout Security MCP server

<!-- mcp-name: io.github.Varpost/scout -->

Scout

AI security team in a CLI. Find vulnerabilities before hackers do — free, local, no signup.

Why Scout?

AI coding assistants write insecure code constantly — hardcoded secrets, SQL injection, missing auth. Solo developers ship it because they don't have a security team.

Scout is that team. Static analysis catches the most common mistakes AI assistants make — leaked keys, string-built SQL, shell=True, missing security headers. No API keys, no config, no cost.

Install

Zero-install — try it in one command with uv (no venv, ~1s cold start):

uvx scout-security scan ./my-project

Or install it permanently:

pip install scout-security

Using NCC ScoutSuite too? It also installs a scout command, and whichever package you installed last owns the name. Scout additionally installs scoutsec — same tool, collision-proof name: scoutsec scan ./my-project.

Usage

# Scan a project — deterministic static analysis: no API keys, no tokens, no signup
scout scan ./my-project

# Turn the findings into ready-to-paste fix prompts for your AI assistant
scout scan ./my-project --format ai-prompt

Output Formats

One scan, four views — choose with --format (-f):

# Layer 1 — human-readable Markdown report (default)
scout scan ./my-app
scout scan ./my-app -o security-report.md

# Layer 2 — ready-to-paste prompts for your own AI (Cursor, Claude, Copilot…)
scout scan ./my-app --format ai-prompt          # writes security-prompts.md
scout scan ./my-app --format ai-prompt -o prompts.md

# Layer 3 — machine-readable JSON for piping into agentic tooling / CI
scout scan ./my-app --format json               # prints JSON to stdout
scout scan ./my-app --format json -o report.json
scout scan ./my-app --format json | jq '.findings[]'

# Layer 4 — SARIF 2.1.0 for GitHub Code Scanning (PR annotations)
scout scan ./my-app --format sarif -o scout.sarif

The same engine powers all of them — Scout finds the problem; your own AI (which already knows your codebase) applies the fix.

Use as a CI Gate

scout scan exits 1 when findings at or above --fail-on (default: high) exist, so your pipeline fails on real problems:

scout scan . --fail-on high        # default — fail on HIGH or CRITICAL findings
scout scan . --fail-on critical    # fail only on CRITICAL
scout scan . --fail-on never       # report-only mode — always exit 0

The GitHub Action wraps install + scan + SARIF upload, so findings show up as PR annotations via GitHub Code Scanning:

jobs:
  scout:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v4
      - uses: Varpost/Scout@v0.1.16
        with:
          fail-on: high            # also: path, format, upload-sarif

Prefer plain steps? The same thing by hand (the job still needs security-events: write):

- run: |
    pip install scout-security
    scout scan . --no-ai --format sarif -o scout.sarif --fail-on never
- uses: github/codeql-action/upload-sarif@v4
  with:
    sarif_file: scout.sarif

Pre-commit Hook

Catch findings before they're ever committed:

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/Varpost/Scout
    rev: v0.1.16        # use the latest tag
    hooks:
      - id: scout

Shortened. The full README is on GitHub.