Log inSubmit server
AI Scanner logo

AI Scanner

Scan codebases for AI usage, exposed tokens, hardcoded secrets, models, SDKs, frameworks, and endpoints.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install AI Scanner

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "ai-scanner": {
      "command": "npx",
      "args": [
        "-y",
        "ai-scanner-mcp"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Automated check passed— started and listed 3 tools correctly (9d ago).

Overview

AI Scanner MCP server exposes codebase scanning through MCP tools for AI agents. It identifies LLM SDKs, AI frameworks, model references, API endpoints, exposed tokens, and hardcoded secrets, with separate inventory and credential-check modes. Install it with npx and connect it to Claude Code, Claude Desktop, Cursor, Windsurf, or another MCP-compatible client. Reach for it during security reviews, pre-commit checks, or when documenting a project's AI stack.

Use cases

  • Scan a project for exposed AI and generic credentials
  • Check a codebase for hardcoded secrets before committing
  • Inventory the SDKs, frameworks, models, and endpoints in use
  • Review source directories for LLM integrations and secret exposure

Key features

  • Detects LLM SDKs and AI frameworks
  • Finds AI tokens and generic hardcoded secrets
  • Reports model references and LLM API endpoints
  • Provides a pass/fail secrets check
  • Supports AI-only and .env scanning options
  • Builds an AI stack inventory without secret detection

Tools3

What AI Scanner lets your agent do. Expand a tool for its parameters.

Verified live~535 tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 3d ago

Recent health check succeeded.

10/15 checks healthy over the last 91d

What it can do

From the 3 tools this server returned when we ran it.

Handles credentials · 3Read-only tools · 3
Network at startup3 connections
Files written at startupNone
Install scriptsNone
npm provenanceNot published
Package age223 days
Maintainers1

Observed 2026-10-31 in an isolated sandbox. A description of reach, not a security audit.

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 2d ago via OSV.dev · ai-scanner-mcp (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars1Stargazers on the source repository.
npm downloads182Package downloads in the last 30 days.
Last commit7mo agoMost recent push to the default branch.
Availability100%Our rolling endpoint + install checks that succeeded.
Install checkPassedOur sandbox started it and listed its tools.
Tools exposed3Callable tools this server registers over MCP.

How AI Scanner works

What AI Scanner MCP server does

The AI Scanner MCP server lets an MCP-compatible AI client inspect a local codebase for AI usage and security findings. It exposes three tools with distinct purposes:

  • scan_directory performs the broadest review, covering LLM SDKs, AI frameworks, exposed AI tokens, generic credentials, model references, and LLM endpoint URLs. Findings include severity levels.
  • check_secrets performs a credential-focused pass/fail check. It is suited to checking a project before committing or pushing changes.
  • ai_inventory describes the AI stack without looking for secrets, including detected SDKs, frameworks, models, and API endpoints.

The scanner advertises coverage for more than 20 AI token types, 59 generic secret patterns, 23 LLM SDKs, and 24 AI frameworks, with 145 detection patterns in total. Examples named by the project include OpenAI, Anthropic, Google, AWS, HuggingFace, Groq, Replicate, LangChain, LlamaIndex, CrewAI, AutoGen, DSPy, and Vercel AI SDK.

How it works

An AI client sends a tool request containing the directory to inspect. The server passes that request to the underlying ai-scanner package and returns the relevant scan or inventory result to the client. Each tool requires a directory path.

scan_directory can be narrowed with ai_only, which skips generic credentials such as Stripe or GitHub tokens. Its scan_env option controls whether .env files are included. Endpoint and model detection are enabled by default and can be controlled with include_endpoints and include_models.

check_secrets also supports ai_only and scan_env. ai_inventory takes only the directory path and does not perform secret detection. The AI Scanner MCP server therefore supports either a security-oriented workflow or an AI-stack discovery workflow without combining their results.

Setup and configuration

The package requires Node.js 18 or newer. Install or launch it through npx as an MCP server; the README provides configurations for Claude Code, Claude Desktop, Cursor, and Windsurf. The command is npx ai-scanner-mcp.

Claude Code uses claude mcp add ai-scanner npx ai-scanner-mcp. Claude Desktop, Cursor, and Windsurf use an MCP server entry whose command is npx and whose argument is ai-scanner-mcp. Claude Desktop stores its configuration under the platform-specific application-support location, while Cursor uses .cursor/mcp.json and Windsurf uses ~/.windsurf/mcp.json.

Tools and capabilities

Use scan_directory for a comprehensive review, check_secrets for a pass/fail credential gate, and ai_inventory when the goal is to understand how a project uses AI without secret scanning. The AI Scanner MCP server can inspect AI-specific tokens separately from generic secrets through the ai_only option.

Limitations and notes

Results depend on the scanner's documented detection patterns. ai_inventory intentionally omits secret detection, so it is not a substitute for scan_directory or check_secrets when credential exposure is the concern. .env files are excluded unless scan_env is enabled. The provided setup documents local stdio-style launching with npx; no hosted service or remote deployment configuration is described.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about AI Scanner

AI Scanner is an MCP server that connects AI agents to the ai-scanner code-scanning engine through MCP. Its main tools are scan_directory for AI usage, frameworks, tokens, and secrets; check_secrets for credential checks; and ai_inventory for SDK, model, framework, and endpoint discovery without secret detection.

Run it with Node.js 18 or newer using npx ai-scanner-mcp. Add that command to the MCP configuration for your client, or use claude mcp add ai-scanner npx ai-scanner-mcp with Claude Code.

Yes, AI Scanner works with Cursor. Add an ai-scanner entry to the project's .cursor/mcp.json file, using npx as the command and ai-scanner-mcp as its argument.

Yes, use the check_secrets tool for a pass/fail credential scan before committing. It checks exposed credentials and can be limited to AI tokens with ai_only; .env files are included only when scan_env is enabled.

Yes, use ai_inventory to identify AI SDKs, frameworks, models, and API endpoints. This tool does not perform secret detection, so use scan_directory when the inventory should also include exposed tokens and hardcoded secrets.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewAI Scanner AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/ai-scanner?style=directory)](https://allmcps.com/mcp/ai-scanner)
HTML Embed
<a href="https://allmcps.com/mcp/ai-scanner"><img src="https://allmcps.com/api/badge/ai-scanner?style=directory" alt="AI Scanner on AllMCPs" /></a>