Log inSubmit server
Arcwall Security logo

Arcwall Security

Security scanning for AI coding tools. Detects secrets, threat models, and runs pre-commit checks.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Arcwall Security

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "arcwall-security": {
      "command": "npx",
      "args": [
        "@arcwall/mcp-server"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

We couldn’t confirm it starts correctly

The install command installed and started the server, which then stopped for configuration (such as an API key) that our sandbox does not have — expected for servers that connect to your account.

npx @arcwall/mcp-server

No response to initialize.

This is an experimental automated check and can have false negatives — missing environment variables, a slow cold install, etc. It doesn’t necessarily mean something’s wrong. Last checked 8d ago.

Overview

Tools7

What Arcwall Security lets your agent do. Expand a tool for its parameters.

Self-reported~79 tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 1d ago

Recent health check succeeded.

9/9 checks healthy over the last 61d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 9d ago via OSV.dev · @arcwall/mcp-server (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars1Stargazers on the source repository.
npm downloads132Package downloads in the last 30 days.
Last commit6mo agoMost recent push to the default branch.
Install checkRunsOur sandbox started it; it then asked for an API key or config.
Tools exposed7Callable tools this server registers over MCP.

From the project README

@arcwall/mcp-server

Security scanning for Claude Code, Cursor, Windsurf, and any MCP-compatible AI coding tool.

Setup

  1. Get your free API key at https://arcwall.io

  2. Add to your MCP config:

Claude Code (~/.claude/mcp.json):

config.json
{
  "mcpServers": {
    "arcwall": {
      "command": "npx",
      "args": ["@arcwall/mcp-server"],
      "env": { "ARCWALL_API_KEY": "your-key-here" }
    }
  }
}

Cursor (.cursor/mcp.json): Same config. Windsurf: Add via MCP settings panel.

  1. Restart your AI tool — Arcwall is ready.

Tools

  • arcwall_scan_secrets — hardcoded credentials
  • arcwall_scan_mcp — MCP config vulnerabilities
  • arcwall_scan_agent_instructions — CLAUDE.md, .cursorrules security
  • arcwall_threat_model — STRIDE analysis
  • arcwall_check_prompt — prompt injection testing
  • arcwall_pre_commit — pre-commit security check
  • arcwall_scan_dependencies — known CVEs in packages

Usage

Ask your AI assistant:

  • "Scan this repo for secrets"
  • "Check my MCP configs for vulnerabilities"
  • "Is my CLAUDE.md safe?"
  • "Generate a threat model for this project"
  • "Run a security check before I commit"
  • "Are there vulnerable packages in this project?"

Links

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Arcwall Security

arcwall-security is an MCP server that provides security scanning for Claude Code, Cursor, Windsurf, and other MCP-compatible AI coding tools. It detects hardcoded secrets, reviews MCP configuration vulnerabilities, checks agent instruction files and prompts, generates STRIDE threat models, scans dependencies for known CVEs, and runs pre-commit security checks.

Set up arcwall-security by getting a free API key at https://arcwall.io, adding the server to your MCP configuration, and restarting your AI coding tool. The configuration uses the npx command with @arcwall/mcp-server and the ARCWALL_API_KEY environment variable; Windsurf also supports adding it through its MCP settings panel.

arcwall-security supports secret scanning, MCP configuration vulnerability scanning, agent instruction security checks, STRIDE threat modeling, prompt injection testing, pre-commit security checks, and dependency scans for known CVEs. Its tools include arcwall_scan_secrets, arcwall_scan_mcp, arcwall_scan_agent_instructions, arcwall_threat_model, arcwall_check_prompt, arcwall_pre_commit, and arcwa…

Yes, arcwall-security can run a pre-commit security check with the arcwall_pre_commit tool. You can ask your AI assistant to run a security check before committing, and you can separately request scans for hardcoded credentials, vulnerable packages, agent instruction files, MCP configurations, or other supported security concerns.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewArcwall Security AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/arcwall-security?style=directory)](https://allmcps.com/mcp/arcwall-security)
HTML Embed
<a href="https://allmcps.com/mcp/arcwall-security"><img src="https://allmcps.com/api/badge/arcwall-security?style=directory" alt="Arcwall Security on AllMCPs" /></a>