v0.1.0 · MIT License
A free, read-only server that lets users diagnose production AI-agent risks: it flags over-privileged API keys from permission descriptions, scans code snippets for the signals that prevent duplicate execution, and explains guard patterns such as idempotency keys, approval gates, outboxes, and circuit breakers. It makes no network calls or writes, and rejects inputs that look like real secrets.
— · Apache 2.0
Exposes an assess_repo tool that scans a repository, local folder, or npm/PyPI package and returns supply-chain risk findings with file, line, and code evidence — install-time scripts, dangerous patterns, secrets, AI-agent manipulation, impersonation and published-artifact mismatches — while never executing the target's code. Findings carry severities from info to critical so results can gate installs and CI jobs.