Armis Security Scanner

AI-powered security scanning forClaude Code,Cursor,VS Code(GitHub Copilot),Gemini CLI,GitHub Copilot CLI,Codex CLI, andCline. Scans code, files, and git diffs for vulnerabilities in real-time using the Armis scanning API.

# 1. Clone the repository git clone https://github.com/ArmisSecurity/armis-appsec-mcp.git cd armis-appsec-mcp # 2. Create credentials cat > .env << 'EOF' ARMIS_CLIENT_ID=<your-client-id> ARMIS_CLIENT_SECRET=<your-client-secret> EOF chmod 600 .env # 3. Generate config for your client make setup CLIENT=cursor # or: vscode, gemini, copilot

{ "mcpServers": { "armis-scanner": { "command": "/path/to/armis-appsec-mcp/run.sh", "args": [] } } }

Runmake setup CLIENT=vscodeand copy the output to.vscode/mcp.jsonin your project.

{ "servers": { "armis-scanner": { "type": "stdio", "command": "/path/to/armis-appsec-mcp/run.sh", "args": [] } } }

Enable MCP in VS Code settings if not already:github.copilot.chat.mcp.enabled: true.

Runmake setup CLIENT=geminiand copy the output to~/.gemini/settings.json(user-level) or.gemini/settings.json(project-level).

Or manually add themcpServersblock to yoursettings.json:

{ "mcpServers": { "armis-scanner": { "command": "/path/to/armis-appsec-mcp/run.sh", "args": [] } } }

Runmake setup CLIENT=copilotand copy the output to.mcp.json(workspace) or~/.copilot/mcp-config.json(user-level).

Copilot CLI requires bothcommandandargsfields. A config withoutargswill be ignored.

Add the MCP server to your Codex CLI config per its documentation. Then wire in the commit gate hook:

make setup CLIENT=codex # prints the hook config JSON

Merge the printedhooksblock into your Codex CLI hooks config file (path varies by installation), replacing/absolute/path/to/armis-appsec-mcpwith the actual clone path.

Add the MCP server via Cline's MCP settings panel. Then wire in the commit gate hook:

make setup CLIENT=cline # prints the hook config JSON

Merge the printedhooksblock into your Clinesettings.json, replacing/absolute/path/to/armis-appsec-mcpwith the actual clone path.

Install via the plugin marketplace for the complete experience (hooks + slash command):

/plugin marketplace add ArmisSecurity/armis-appsec-mcp /plugin install armis-appsec@armis-appsec-mcp

PLUGIN_DIR="$(ls -dt ~/.claude/plugins/cache/armis-appsec-mcp/armis-appsec/*/ | head -1)" cat > "$PLUGIN_DIR/.env" << 'EOF' ARMIS_CLIENT_ID=<your-client-id> ARMIS_CLIENT_SECRET=<your-client-secret> EOF chmod 600 "$PLUGIN_DIR/.env"

"Native hook" = PreToolUse hook wired into the client's tool pipeline (blocks the command before it runs, injects a scan instruction). "Git hook" = portablepre-commitscript (installed viamake install-hooks). VS Code is the only client without a native hook template.

For a client-agnostic commit gate that works regardless of which AI tool you use:

This installs a git pre-commit hook that verifies the scan-pass (stored inside.git/, so it never clutters your working tree) before allowing commits. It failsopenby default (plugin bugs never block developers). SetAPPSEC_HOOK_STRICT=1for fail-closed behavior.

To test uncommitted changes from a clone end-to-end in Claude Code (or any client that loads the installed plugin), point the installed plugin at your working tree:

make dev-install # backs up the installed plugin, symlinks it -> this repo # ...restart Claude Code, then test... make dev-uninstall # restores the backed-up plugin exactly make dev-status # show whether dev mode is active

dev-installbacks up the real plugin tolatest.bak, symlinkslatestto this repo, and copies the installed.env(credentials) over so the launcher's preflight still passes.Restart Claude Code after each install/uninstall— MCP servers launch at session start. Override the cache location withPLUGIN_CACHE=...if your plugins live elsewhere.

Or ask your AI assistant: "scan staged changes for security issues"

Paste code into the conversation and ask:

When the git pre-commit hook is installed, or when using Claude Code's native hooks:
- Blocks the command until code is scanned
- The AI assistant scans the changes automatically
- Allows the command after a clean scan (no HIGH/CRITICAL findings)

If HIGH/CRITICAL findings are found, the assistant will attempt to fix them. If findings remain after remediation, it asks for your approval before proceeding.

For teams that want a single shared scanner instance:

Then configure clients to connect via HTTP instead of launching a local process.

Requires macOS or Linux. On Windows, use WSL2.

make check # full CI gate (format + lint + typecheck + test) make test # pytest only pytest hooks/tests/test_pre_commit_scan.py -v # specific test file

+---------------------+ | Armis Cloud | | POST /scan/fast | +--------+------------+ ^ | HTTPS (JWT Bearer) +--------+------------+ | Scanner Core | | scanner_core.py | +--------+------------+ +-----+------+ | | +-----v-----+ +---v---------+ | MCP Server | | Git Hook | | server.py | | git-hooks/ | +------------+ +-------------+ | +------------+-------------+ | | | Claude Cursor VS Code/ Code Gemini Copilot

Apache License 2.0 — seeLICENSEfor details.

AI-powered code quality analysis to detect best practice violations, security issues, and architectural problems in real-time.