Tools
| Tool | Description |
|---|---|
scan_directory | Full scan — LLM SDKs, AI frameworks, exposed tokens, and hardcoded secrets with severity levels |
check_secrets | Security check — pass/fail scan for exposed credentials only. Perfect for pre-commit checks |
ai_inventory | AI stack overview — which SDKs, frameworks, models, and API endpoints are used (no secret detection) |
Setup
Claude Code
claude mcp add ai-scanner npx ai-scanner-mcp
Claude Desktop
Add to your claude_desktop_config.json:
{
"mcpServers": {
"ai-scanner": {
"command": "npx",
"args": ["ai-scanner-mcp"]
}
}
}
Config file location:
- macOS:
~/Library/Application Support/Claude/claude_desktop_config.json - Windows:
%APPDATA%\Claude\claude_desktop_config.json
Cursor
Add to .cursor/mcp.json in your project:
{
"mcpServers": {
"ai-scanner": {
"command": "npx",
"args": ["ai-scanner-mcp"]
}
}
}
Windsurf
Add to ~/.windsurf/mcp.json:
{
"mcpServers": {
"ai-scanner": {
"command": "npx",
"args": ["ai-scanner-mcp"]
}
}
}
Example Usage
Once connected, you can ask your AI agent:
- "Scan this project for any exposed API keys"
- "Check if there are any hardcoded secrets before I commit"
- "What AI SDKs and frameworks does this codebase use?"
- "Run a security scan on ./src and tell me if it's safe to push"
- "Give me an AI inventory of this project"
Tool Details
scan_directory
Full scan with all detection categories. Parameters:
| Parameter | Type | Default | Description |
|---|---|---|---|
directory | string | required | Path to scan |
ai_only | boolean | false | Skip generic secrets (Stripe, GitHub, etc.) |
scan_env | boolean | false | Include .env files |
include_endpoints | boolean | true | Detect LLM API endpoint URLs |
include_models | boolean | true | Detect model name references |
check_secrets
Security-focused pass/fail check. Parameters:
| Parameter | Type | Default | Description |
|---|---|---|---|
directory | string | required | Path to scan |
ai_only | boolean | false | Only check AI tokens |
scan_env | boolean | false | Include .env files |
ai_inventory
AI stack awareness (no secret detection). Parameters:
| Parameter | Type | Default | Description |
|---|---|---|---|
directory | string | required | Path to scan |
Detection Coverage
- AI Tokens (20+) — OpenAI, Anthropic, Google, AWS, HuggingFace, Groq, Replicate, and more
- Generic Secrets (59) — Stripe, Twilio, GitHub, Slack, Discord, database URIs, private keys, JWTs
- LLM SDKs (23) — OpenAI, Anthropic, Google Gemini, LiteLLM, AWS Bedrock, and more
- AI Frameworks (24) — LangChain, LlamaIndex, CrewAI, AutoGen, DSPy, Vercel AI SDK, and more
- 145 total detection patterns