1. Conduid
  2. Blockchain
  3. AI Scanner
MCP server · Blockchain

AI Scanner

by · github.com/sky-in-code/ai-scanner-mcp

Scan codebases for LLM/AI SDK usage, exposed API tokens, and hardcoded secrets.

Unclaimed last commit 7 months ago blockchain
InstallView source
37Low

Scored 6 months ago · breakdown

About AI Scanner

AI Scanner is an MCP server published by sky-in-code in the Blockchain category: scan codebases for LLM/AI SDK usage, exposed API tokens, and hardcoded secrets.

The repository has 1 stars and 1 forks, with the last commit 7 months ago. Six months or more without a commit doesn't mean the server is broken, but check the open issues before depending on it in production.

Install

Claude Code
claude mcp add ai-scanner -- npx -y ai-scanner-mcp
npx
npx -y ai-scanner-mcp

This server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.

Tools (3)

ai_inventoryAI stack overview — which SDKs, frameworks, models, and API endpoints are used (no secret detection)

Parameters not published.

check_secretsSecurity check — pass/fail scan for exposed credentials only. Perfect for pre-commit checks

Parameters not published.

scan_directoryFull scan — LLM SDKs, AI frameworks, exposed tokens, and hardcoded secrets with severity levels

Parameters not published.

Ask AI

✦

Ask AI about AI Scanner

Powered by Claude · Grounded in docs

I know everything about AI Scanner. Ask me about installation, configuration, usage, or troubleshooting.

Security checks

  • ✓README presentThe repository ships documentation.

5 checks have not been run yet.

README

An MCP server that exposes ai-scanner as tools for AI agents. Works with Claude Code, Claude Desktop, Cursor, Windsurf, and any MCP-compatible client.

Tools

Tool Description
scan_directory Full scan — LLM SDKs, AI frameworks, exposed tokens, and hardcoded secrets with severity levels
check_secrets Security check — pass/fail scan for exposed credentials only. Perfect for pre-commit checks
ai_inventory AI stack overview — which SDKs, frameworks, models, and API endpoints are used (no secret detection)

Setup

Claude Code

claude mcp add ai-scanner npx ai-scanner-mcp

Claude Desktop

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "ai-scanner": {
      "command": "npx",
      "args": ["ai-scanner-mcp"]
    }
  }
}

Config file location:

  • macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
  • Windows: %APPDATA%\Claude\claude_desktop_config.json

Cursor

Add to .cursor/mcp.json in your project:

{
  "mcpServers": {
    "ai-scanner": {
      "command": "npx",
      "args": ["ai-scanner-mcp"]
    }
  }
}

Windsurf

Add to ~/.windsurf/mcp.json:

{
  "mcpServers": {
    "ai-scanner": {
      "command": "npx",
      "args": ["ai-scanner-mcp"]
    }
  }
}

Example Usage

Once connected, you can ask your AI agent:

  • "Scan this project for any exposed API keys"
  • "Check if there are any hardcoded secrets before I commit"
  • "What AI SDKs and frameworks does this codebase use?"
  • "Run a security scan on ./src and tell me if it's safe to push"
  • "Give me an AI inventory of this project"

Tool Details

scan_directory

Full scan with all detection categories. Parameters:

Parameter Type Default Description
directory string required Path to scan
ai_only boolean false Skip generic secrets (Stripe, GitHub, etc.)
scan_env boolean false Include .env files
include_endpoints boolean true Detect LLM API endpoint URLs
include_models boolean true Detect model name references

check_secrets

Security-focused pass/fail check. Parameters:

Parameter Type Default Description
directory string required Path to scan
ai_only boolean false Only check AI tokens
scan_env boolean false Include .env files

ai_inventory

AI stack awareness (no secret detection). Parameters:

Parameter Type Default Description
directory string required Path to scan

Detection Coverage

  • AI Tokens (20+) — OpenAI, Anthropic, Google, AWS, HuggingFace, Groq, Replicate, and more
  • Generic Secrets (59) — Stripe, Twilio, GitHub, Slack, Discord, database URIs, private keys, JWTs
  • LLM SDKs (23) — OpenAI, Anthropic, Google Gemini, LiteLLM, AWS Bedrock, and more
  • AI Frameworks (24) — LangChain, LlamaIndex, CrewAI, AutoGen, DSPy, Vercel AI SDK, and more
  • 145 total detection patterns

License

MIT

README copy captured when this server was indexed; it may lag the repository. The original is authoritative.

Questions

About AI Scanner

How do I install AI Scanner?

Run claude mcp add ai-scanner -- npx -y ai-scanner-mcp, then add the server to your MCP client's configuration.

Is AI Scanner safe to use with an AI agent?

Its trust score is 37 out of 100 (low). It passes 1 of the 1 static security checks run so far. It has no ConduID identity yet, so agent calls to it are not receipted.

Is AI Scanner still maintained?

The last commit was 7 months ago. That's long enough that you should check whether the maintainer is responding to issues before depending on it.