mycop

mycop was built specifically to solve this problem:

- First SAST tool designed for AI-generated code-- 200 rules targeting the exact vulnerability patterns that LLMs produce most often, covering OWASP Top 10 and CWE Top 25.
- AI-powered auto-fix, not just detection-- mycop does not just find vulnerabilities, it fixes them. Themycop fixcommand rewrites insecure code using AI while preserving functionality.
- Multi-language with a single tool-- scan Python, JavaScript, TypeScript, Go, and Java codebases without juggling Bandit, ESLint, and separate configs.
- Zero configuration-- all 200 security rules are compiled into the binary. No rule downloads, no config files, no internet connection required. Justmycop scan .and go.
- MCP server for agentic workflows-- plug mycop directly into Claude Code, Cursor, Windsurf, and other AI coding assistants via the Model Context Protocol.
- Free and open source-- MIT licensed, forever.

curl -fsSL https://raw.githubusercontent.com/AbdumajidRashidov/mycop/main/install.sh | sh

brew install AbdumajidRashidov/tap/mycop

docker run --rm -v "$(pwd):/src" -w /src ghcr.io/abdumajidrashidov/mycop scan .

git clone https://github.com/AbdumajidRashidov/mycop.git cd mycop cargo install --path .

# Scan current directory mycop scan . # Auto-fix all vulnerabilities using AI mycop fix . # Deep AI security review of a single file mycop review src/auth.py # Initialize config for your project mycop init # List all security rules mycop rules list

Scan files for security vulnerabilities.

mycop scan . # Scan current directory mycop scan src/ lib/ # Scan specific directories mycop scan --severity high # Only report high/critical mycop scan --fail-on critical # Exit 1 only on critical findings mycop scan --format json # JSON output mycop scan --format sarif # SARIF output (for IDE integration) mycop scan --explain # AI-powered explanations mycop scan --diff # Only scan git-changed files mycop scan --fix # Auto-fix (same as mycop fix)

Exit code 1 when findings meet the--fail-onthreshold (default: high).

Auto-fix security vulnerabilities using AI. Groups all findings per file, sends the entire file to an AI provider, and writes back the fixed version.

mycop fix . # Fix all files mycop fix src/auth.py # Fix specific file mycop fix . --severity high # Only fix high/critical mycop fix . --dry-run # Show diffs without writing mycop fix . --ai-provider anthropic # Force specific AI provider mycop fix . --diff # Only fix git-changed files

Deep AI-powered security review of a single file. Goes beyond rule matching to find logic flaws, race conditions, and architectural issues.

mycop review src/server.ts mycop review app.py --ai-provider openai

Generate a.scanrc.ymlconfiguration file. Automatically detects your project type (Python, JavaScript/TypeScript, Rust) and pre-populates language-specific ignore patterns.

mycop rules list # All rules mycop rules list --language python # Python rules only mycop rules list --severity high # High/critical rules only

Check dependencies for issues (hallucinated packages).

mycop deps check . mycop deps check requirements.txt

Start an MCP (Model Context Protocol) server over STDIO for agentic tool integration. This lets AI coding assistants call mycop's scanning, fixing, and review capabilities directly.

Note:The CLImycop fixcommand is still available for standalone use. In MCP mode, the agent reads scan findings (withfix_hint) and applies fixes directly — no redundant AI-to-AI call needed.

Resources:mycop://rules/catalog(full JSON catalog) andmycop://config/schema(config template).

Configure in Claude Code(~/.claude/settings.json):

Supported clients: Claude Code, Cursor, Windsurf, Codex CLI, Gemini CLI, and any MCP-compatible IDE or agent.

Add mycop to your CI pipeline with the official GitHub Action:

- name: mycop Security Scan uses: AbdumajidRashidov/mycop/action@main with: paths: '.' fail-on: 'high' format: 'sarif'

Upload SARIF results to GitHub Code Scanning:

- name: mycop Security Scan uses: AbdumajidRashidov/mycop/action@main with: format: 'sarif' - name: Upload SARIF uses: github/codeql-action/upload-sarif@v3 with: sarif_file: mycop-results.sarif

# .pre-commit-config.yaml repos: - repo: https://github.com/AbdumajidRashidov/mycop rev: main hooks: - id: mycop

Thevscode-extension/directory contains a VS Code extension that provides:

- Real-time scanning on file save
- Diagnostics in the Problems panel
- "Scan Current File" and "Scan Workspace" commands
- Configurable severity threshold

# Scan current directory docker run --rm -v "$(pwd):/src" -w /src ghcr.io/abdumajidrashidov/mycop scan . # Scan with specific options docker run --rm -v "$(pwd):/src" -w /src ghcr.io/abdumajidrashidov/mycop scan . --format json --severity high

Contributions are welcome! Whether it is a bug report, a new security rule, a feature request, or a pull request, we appreciate your help in making mycop better.
- Fork the repository and create your branch frommain.
- Make your changes and ensure all checks pass:

cargo fmt --all -- --check cargo clippy --all-targets -- -D warnings cargo test --verbose

Provides AI agents with access to development best practices, security guidelines, and coding standards.

Run Shipcheck repo risk scans from MCP coding agents.

An intelligent security agent that analyzes AI-generated code for vulnerabilities and assists with remediation.

Zephex is a hosted MCP gateway built for AI coding editors. It gives your agent 10 ready-to-use tools — check npm packages for vulnerabilities, audit security headers, read and search code, trace request flows, get project context from any repo, and more. One API key, works instantly with Claude Code, Cursor, VS Code, Windsurf, and others. Free to start at zephex.dev.

Zephex is a hosted MCP gateway built for AI coding editors. It gives your agent 10 ready-to-use tools — check npm packages for vulnerabilities, audit security headers, read and search code, trace request flows, get project context from any repo, and more. One API key, works instantly with Claude Code, Cursor, VS Code, Windsurf, and others. Free to start at zephex.dev.

A lightweight dependency vulnerability audit tool that works as both a CLI and an MCP Server — so your AI coding assistant can find and fix security issues for you

Structural code context server for AI agents — zero vector database, zero embedding API, fully local.

Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning with Cycode.

Enable AI agents to secure code with Semgrep.