ai-scanner-mcp

MCP server for ai-scanner - let AI agents scan codebases for LLM usage, AI frameworks, and exposed secrets.

An MCP server that exposes ai-scanner as tools for AI agents. Works with Claude Code, Claude Desktop, Cursor, Windsurf, and any MCP-compatible client.

Tools

Setup

Claude Code

claude mcp add ai-scanner npx ai-scanner-mcp

Claude Desktop

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "ai-scanner": {
      "command": "npx",
      "args": ["ai-scanner-mcp"]
    }
  }
}

Config file location:

• macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
• Windows: %APPDATA%\Claude\claude_desktop_config.json

Cursor

Add to .cursor/mcp.json in your project:

{
  "mcpServers": {
    "ai-scanner": {
      "command": "npx",
      "args": ["ai-scanner-mcp"]
    }
  }
}

Windsurf

Add to ~/.windsurf/mcp.json:

{
  "mcpServers": {
    "ai-scanner": {
      "command": "npx",
      "args": ["ai-scanner-mcp"]
    }
  }
}

Example Usage

Once connected, you can ask your AI agent:

• "Scan this project for any exposed API keys"
• "Check if there are any hardcoded secrets before I commit"
• "What AI SDKs and frameworks does this codebase use?"
• "Run a security scan on ./src and tell me if it's safe to push"
• "Give me an AI inventory of this project"

Tool Details

scan_directory

Full scan with all detection categories. Parameters:

check_secrets

Security-focused pass/fail check. Parameters:

ai_inventory

AI stack awareness (no secret detection). Parameters:

Detection Coverage

• AI Tokens (20+) — OpenAI, Anthropic, Google, AWS, HuggingFace, Groq, Replicate, and more
• Generic Secrets (59) — Stripe, Twilio, GitHub, Slack, Discord, database URIs, private keys, JWTs
• LLM SDKs (23) — OpenAI, Anthropic, Google Gemini, LiteLLM, AWS Bedrock, and more
• AI Frameworks (24) — LangChain, LlamaIndex, CrewAI, AutoGen, DSPy, Vercel AI SDK, and more
• 145 total detection patterns

License

MIT