mycop — AI Code Security Scanner
Description: Detect and auto-fix vulnerabilities in AI-generated code. 100 built-in security rules, 5 AI providers, SARIF output. Open source.

Open-source security scanner

# Catch vulnerabilities in
AI-generated code

mycop scans Python, JavaScript, and TypeScript for security issues that AI coding assistants commonly introduce. 100 built-in rules, AI-powered auto-fix, zero config.

$ `curl -fsSL https://raw.githubusercontent.com/AbdumajidRashidov/mycop/main/install.sh | sh`
View on GitHub
mycop
$ mycop scan src/ Scanning 12 files... CRITICAL src/auth.py:24 PY-SEC-001 SQL injection via string formatting in query query = f"SELECT * FROM users WHERE id = {user_id}" HIGH src/utils.js:8 JS-SEC-002 Dangerous eval() call with user-controlled input const result = eval(req.body.expression) MEDIUM src/config.py:15 PY-SEC-003 Hardcoded secret detected in source code API_KEY = "sk-live-a1b2c3d4e5f6" Found 3 findings (1 critical, 1 high, 1 medium) $ mycop fix src/ --dry-run Fixed src/auth.py — parameterized query Fixed src/utils.js — replaced eval with safe parser Fixed src/config.py — moved secret to environment variable
Features

## Security scanning, built for modern dev workflows

Everything you need to keep AI-generated code safe, from detection to automated remediation.

### 100 Built-in Rules

Covers OWASP Top 10 and CWE Top 25 including SQL injection, XSS, command injection, cryptography flaws, auth issues, and more. All mapped to CWE identifiers.

### AI-Powered Auto-Fix

Automatically rewrites vulnerable code using Claude, GPT-4, Ollama, or any supported provider. Review diffs before applying.

### Inline Ignore

Suppress specific findings with `# mycop-ignore:RULE-ID` comments. Supports all rules or specific IDs.

### Multiple Output Formats

Terminal output with colored context, JSON for scripting, and SARIF for IDE and CI integration like GitHub Code Scanning.

### 5 AI Providers

Auto-detects Claude CLI, Anthropic API, OpenAI, Ollama, or falls back to rule-based hints. No AI required for scanning.

### Configurable Thresholds

Set minimum severity to report and separate fail threshold for CI gates via CLI flags or `.scanrc.yml` config.

Language Support

## Scan the languages you ship

Pattern matching and AST-level analysis for the most common AI-assisted languages.

Python
JavaScript
TypeScript
Installation

## Get started in seconds

Choose your preferred installation method.

`# macOS & Linux curl -fsSL https://raw.githubusercontent.com/AbdumajidRashidov/mycop/main/install.sh | sh # Verify installation mycop --version`
`brew install AbdumajidRashidov/tap/mycop`
`cargo install mycop`
`docker run --rm -v "$(pwd):/src" -w /src mycop scan .`
Integrations

## Fits into your existing workflow

Use mycop in CI, as a git hook, or directly in your editor.

### GitHub Action

Add security scanning to your CI pipeline

- name: mycop Security Scan uses: AbdumajidRashidov/mycop/action@main with: paths: '.' fail-on: 'high' format: 'sarif'

### Pre-commit Hook

Catch issues before they reach the repo

# .pre-commit-config.yaml repos: - repo: https://github.com/AbdumajidRashidov/mycop rev: main hooks: - id: mycop

### VS Code Extension Coming Soon

Real-time security diagnostics in your editor

// Scan on save // Diagnostics in Problems panel // Commands: "mycop: Scan Current File" "mycop: Scan Workspace" // Configure in settings.json: "mycop.severity": "medium" "mycop.scanOnSave": true
Security Rules

## 100 rules covering OWASP Top 10 & CWE Top 25

50 Python + 50 JavaScript rules, each mapped to CWE identifiers for standards compliance.

Category | Python | JavaScript
--- | --- | ---
SQL Injection (CWE-89) | PY-SEC-001, 042 | JS-SEC-011
Command Injection (CWE-78) | PY-SEC-002, 045, 050 | JS-SEC-016
Hardcoded Secrets (CWE-798) | PY-SEC-003, 034, 043 | JS-SEC-004, 034
Insecure Random (CWE-330) | PY-SEC-004 | JS-SEC-005
Eval/Exec Injection (CWE-95) | PY-SEC-005 | JS-SEC-002, 049
Path Traversal / Zip Slip (CWE-22) | PY-SEC-006, 037 | JS-SEC-006, 037
Insecure Deserialization (CWE-502) | PY-SEC-007 | JS-SEC-009
XSS (CWE-79) | PY-SEC-009, 044 | JS-SEC-001, 010, 041
SSRF (CWE-918) | PY-SEC-011 | JS-SEC-007
XXE (CWE-611) | PY-SEC-012 | JS-SEC-012
Template Injection (CWE-1336) | PY-SEC-014 | JS-SEC-013
Weak Crypto (CWE-327/328) | PY-SEC-017–021 | JS-SEC-017–022
Insecure TLS (CWE-295) | PY-SEC-022 | JS-SEC-021
JWT None Alg (CWE-345) | PY-SEC-023 | JS-SEC-023
Open Redirect (CWE-601) | PY-SEC-027 | JS-SEC-027
CORS Misconfiguration (CWE-942) | PY-SEC-028 | JS-SEC-028
Mass Assignment (CWE-915) | PY-SEC-029 | JS-SEC-030
Debug Mode (CWE-215) | PY-SEC-031 | JS-SEC-031
Timing Attack (CWE-208) | PY-SEC-046 | JS-SEC-046
ReDoS (CWE-1333) | PY-SEC-047 | JS-SEC-047
… and 20+ more categories. Run `mycop rules list` for the full list.