Developer Security for AI Applications

AI applications and agents have source-code-level security risks: unsafe tool execution, secrets exposure, prompt injection in code paths, and RAG/model integration gaps. These must be caught before commit or merge.

Audit AI application and agent source code before commit, push, merge, or deployment — with explicit coverage, reproducible findings, and tamper-evident security evidence. Uses Semgrep 1.173.0 as its execution engine with a bundled Public Core rulepack.

Semgrep 1.173.0 (external engine) with bundled Public Core rulepack. Static analysis only — does not execute target code.

• •Scan Receipt (SHA-256 digests for finding set, concern families, coverage, evaluated checks)
• •Evidence Envelope (binds receipt to execution context, producer identity, target identity)
• •Proof-of-fix comparison (STILL_PRESENT, NEW, NOT_VERIFIABLE)
• •Coverage accounting (DISCOVERED, INTENTIONALLY_EXCLUDED, UNSUPPORTED, TARGETED, ENGINE_REPORTED_SCANNED, PARSE_FAILED, SUCCESSFULLY_ANALYZED)

MCP identifier: io.github.subodhkc/ai-appsec · Transport: stdio

{
  "mcpServers": {
    "ai-appsec": {
      "command": "npx",
      "args": ["-y", "ai-appsec"]
    }
  }
}

• •Static analysis only — no runtime behavioral evidence
• •No compliance certification or assessment
• •No tenant isolation checking (roadmap)
• •No LLM content verification (roadmap)
• + 4 more — see product page

Multi-tenant SaaS and MCP servers can leak data across tenants when queries, cache keys, file access, API responses, or MCP tool visibility are not properly scoped to the authenticated tenant.

Detect cross-tenant security gaps across queries, APIs, caches, files, credentials, sessions, vector stores, and MCP tools before they become production data leaks. 57 deterministic rules covering tenant isolation, tool visibility, cache key scoping, RLS, IDOR, and credential vault isolation.

Babel AST parser for TypeScript/JavaScript. Dedicated Prisma schema parser. SQL migration parser for RLS detection. MCP SDK import detection. IR and Flow Graph with intra-procedural taint tracking.

• •Scan Receipt (SHA-256 hash, rulepack digest, timestamp)
• •Evidence Envelope for verifiable scan artifacts
• •v2 semantic fingerprints (stable under line movement)
• •Proof-of-fix tracking (STILL_PRESENT, NEW, NOT_VERIFIABLE)

MCP identifier: io.github.subodhkc/mcp-tenant-isolation · Transport: stdio

{
  "mcpServers": {
    "tenant-isolation": {
      "command": "npx",
      "args": ["-y", "mcp-tenant-isolation", "mcp"]
    }
  }
}

• •Intra-procedural flow analysis only — does not trace across function calls, files, or middleware boundaries
• •No runtime verification — cannot verify database-level RLS enforcement or middleware execution
• •TypeScript and JavaScript only — Python, Go, Ruby not supported yet
• •False positives are possible — pattern-based detection with FP filtering
• + 1 more — see product page

LLMs hallucinate facts, leak PII in responses, follow prompt injections buried in user input, and drift in quality. You need a guardrail between the model output and your users.

A safety layer that sits between your LLM and your users. Deterministic, pattern-based engines run locally — no model calls, no network on the free tier. Same input plus same rules equals same result. Every result carries an explicit limitations array stating what was and was not checked.

Deterministic, pattern-based engines running locally. No model calls, no network on free tier. Free tier limit: 500 verification calls/day (tracked locally).

• •Risk level and findings per verification
• •Explicit limitations array per result
• •Hash-only audit log entries (SOC 2 / HIPAA / GDPR evidence)
• •Runtime monitoring metrics (latency, token drift, behavioral changes)

• •Cannot definitively prove hallucinations — signals are pattern-based, not ground-truth verification
• •Does not replace human review — use to triage, not to approve
• •PII detection is regex-based (~90% for standard formats, lower for variations)
• •Prompt-injection detection is pattern-based — novel or obfuscated injections can evade it
• + 2 more — see product page