Skip to main content
← Developer Security/SOURCE layer

AI AppSec

Evidence-backed AppSec for AI applications and agents.

Audit AI application and agent source code before commit, push, merge, or deployment — with explicit coverage, reproducible findings, and tamper-evident security evidence.

Versionv0.1.0prerelease
Packageai-appsec
npmnpm
GitHub
MCPio.github.subodhkc/ai-appsec
LicenseMIT
Changelog
Verified 2026-08-22
$ npm install -g ai-appsec

What AI AppSec Does

AI AppSec produces deterministic, reproducible static security evidence for AI-agent and AI-application source code. It uses Semgrep 1.173.0 as its execution engine with a bundled Public Core rulepack (122 detectors, 79 security checks).

Static analysis only

Does not execute target code

No network required

Normal scans run fully offline after setup

No account needed

No HAIEC account or API key required

Deterministic evidence

Scan Receipts with SHA-256 digests

Finding kinds

PRESENCERISK_SIGNALCONTROL_GAPVULNERABILITY

Severity levels

CRITICALHIGHMEDIUMLOWINFO

Dispositions

INFORMATIONALREVIEWBLOCK

Rule Architecture

AI AppSec uses a bundled Public Core rulepack with 122 detectors and 79 security checks. Detectors identify patterns; security checks evaluate whether those patterns represent risks.

Security concern families

Findings are grouped into concern families for decision-quality presentation. A concern family is a deterministic grouping view — it is not necessarily one vulnerability, one material issue, or one root cause. Underlying finding instances remain auditable.

Concern family count is not a vulnerability count. Top 20 / Top 50 are presentation limits, not evidence limits.

Supported file types

PythonTypeScriptJavaScriptJSXTSX

Extensions: .py, .js, .jsx, .ts, .tsx

What scan_ai_security checks

  • • Unsafe AI-output execution
  • • Secrets exposure
  • • RAG / model integration risks
  • • Insecure AI API usage
  • • Control gaps
  • • Prompt / input-related risk signals

Evidence & Receipts

Scan Receipt

Every scan produces a tamper-evident Scan Receipt with SHA-256 digests for:

  • • Finding set
  • • Concern family set
  • • Coverage file sets
  • • Evaluated security checks and detectors
  • • Semantic receipt identity

COMPLETE scans produce reproducible receipts across processes and operating systems. PARTIAL scans preserve run-specific coverage differences.

Evidence Envelope

Each scan produces an Evidence Envelope that binds the receipt to the scan execution context, including producer identity, target identity (scan input digest, git commit, dirty state), execution status and completeness, semantic receipt digest, and envelope digest.

Proof-of-fix

Rescan a target after a fix to compare receipts. The proof-of-fix comparison is safe: it verifies that a specific security check's findings were resolved without requiring the entire scan to be identical. Findings are tagged as STILL_PRESENT, NEW, or NOT_VERIFIABLE.

Coverage Accounting

AI AppSec provides explicit coverage accounting so you always know what was and was not analyzed. Missing evidence is never interpreted as PASS.

DISCOVEREDAll files found beneath the target
INTENTIONALLY_EXCLUDEDFiles excluded by scope policy
UNSUPPORTEDFiles outside supported extensions
TARGETEDSupported files intended for analysis
ENGINE_REPORTED_SCANNEDFiles Semgrep reports as scanned
PARSE_FAILEDFiles with parse errors
SUCCESSFULLY_ANALYZEDScanned minus parse failures

COMPLETE / PARTIAL / ERROR

COMPLETE: All supported files in scope were successfully analyzed.
PARTIAL: Some supported files could not be analyzed (e.g., parser failures). PARTIAL scans cannot prove absence of findings. Missing evidence is never interpreted as PASS.
ERROR: The scan could not complete due to an engine error.

MCP Integration

AI AppSec runs as an MCP server via stdio transport. Plug it into Claude Desktop, Cursor, Windsurf, or any MCP-compatible agent.

MCP identifier: io.github.subodhkc/ai-appsec

Transport: stdio only

MCP server configuration

{
  "mcpServers": {
    "ai-appsec": {
      "command": "npx",
      "args": ["-y", "ai-appsec"]
    }
  }
}

MCP tool: scan_ai_security

The only tool implemented in v0.1. Scans AI/LLM/agent application source code for security risks. Returns findings with coverage, concern families, and scan receipt.

Write access: No — read-only scan tool.

Use with your AI coding agent

MCP identifier: io.github.subodhkc/ai-appsec · Transport: stdio

Configuration file

.cursor/mcp.json
{
  "mcpServers": {
    "ai-appsec": {
      "command": "npx",
      "args": ["-y", "ai-appsec"]
    }
  }
}

Project rule: .cursor/rules/ai-appsec.md

# ai-appsec Security Rule

Use the ai-appsec MCP server to scan code for security issues.
When the user asks to "scan", "audit", or "check security", invoke the appropriate MCP tool.
Always report findings by severity (CRITICAL first).
Do not merge code with unresolved CRITICAL findings.

Copyable agent recipes

Security review this PR

Run `npx ai-appsec` and use scan_ai_security to scan ./src. Report findings by severity (CRITICAL first). Do not merge if CRITICAL findings are present.

Scan this AI agent before merge

Use scan_ai_security to scan the current project. List all CRITICAL and HIGH findings with file paths and remediation hints.

Check for prompt injection in code

Use scan_ai_security to scan ./src. Filter findings to prompt/input-related risk signals. Report each with file, line, and severity.

CI/CD Usage

Run AI AppSec in your CI pipeline before merge or deployment. Use the CLI directly or integrate with GitHub Actions.

CLI commands

$ ai-appsec doctor
$ ai-appsec setup
$ ai-appsec

doctor — check Semgrep status

setup — install Semgrep engine (requires network)

(no args) — start MCP server (stdio transport)

Offline / local operation

Normal scanning operates fully offline after prerequisites are installed. No HAIEC cloud access required. No account or API key required. No rule download during scanning. No telemetry emitted (Semgrep invoked with --metrics off).

ai-appsec setup may require network access to install the Semgrep engine. Once installed, all scanning is local.

Limitations

What AI AppSec does not do

  • •Static analysis only — no runtime behavioral evidence
  • •No compliance certification or assessment
  • •No tenant isolation checking (roadmap)
  • •No LLM content verification (roadmap)
  • •No deploy security gating (roadmap)
  • •PARTIAL scans cannot prove absence of findings
  • •Requires Semgrep 1.173.0 (exact version match, installed separately)
  • •Only scan_ai_security tool implemented in v0.1

Roadmap (not yet implemented)

These are future capabilities. They are not available in the current release and should not be presented as current features.

Tenant isolation checking (scan_tenant_isolation)LLM/runtime content verification (verify_llm_content)Deploy security gating (check_deploy_security)Native deterministic dataflow analysisRuntime evidenceInventory evidenceRegulatory evidenceCompliance/assurance integration

Trust & Security

License

MIT — open source, free to use

Semgrep prerequisite

Requires Semgrep 1.173.0 (exact version match). Not bundled — installed separately via ai-appsec setup.

GitHub repositorynpm packageSecurity policy

AI AppSec vs HAIEC Platform AI Security Scanner

AI AppSec is an independent open-source package (122 detectors, 79 security checks, Semgrep-backed). The HAIEC Platform AI Security Scanner is a separate product with its own rule set (122 detectors, 79 security checks). They are distinct tools with different rule counts and capabilities. Do not conflate them.