Catch vulnerabilities in
AI-generated code
mycop scans Python, JavaScript, and TypeScript for security issues that AI coding assistants commonly introduce. 100 built-in rules, AI-powered auto-fix, zero config.
curl -fsSL https://raw.githubusercontent.com/AbdumajidRashidov/mycop/main/install.sh | sh
Security scanning, built for modern dev workflows
Everything you need to keep AI-generated code safe, from detection to automated remediation.
100 Built-in Rules
Covers OWASP Top 10 and CWE Top 25 including SQL injection, XSS, command injection, cryptography flaws, auth issues, and more. All mapped to CWE identifiers.
AI-Powered Auto-Fix
Automatically rewrites vulnerable code using Claude, GPT-4, Ollama, or any supported provider. Review diffs before applying.
Inline Ignore
Suppress specific findings with # mycop-ignore:RULE-ID
comments. Supports all rules or specific IDs.
Multiple Output Formats
Terminal output with colored context, JSON for scripting, and SARIF for IDE and CI integration like GitHub Code Scanning.
5 AI Providers
Auto-detects Claude CLI, Anthropic API, OpenAI, Ollama, or falls back to rule-based hints. No AI required for scanning.
Configurable Thresholds
Set minimum severity to report and separate fail threshold for CI gates via CLI flags or .scanrc.yml config.
Scan the languages you ship
Pattern matching and AST-level analysis for the most common AI-assisted languages.
Get started in seconds
Choose your preferred installation method.
# macOS & Linux
curl -fsSL https://raw.githubusercontent.com/AbdumajidRashidov/mycop/main/install.sh | sh
# Verify installation
mycop --versionbrew install AbdumajidRashidov/tap/mycopcargo install mycopdocker run --rm -v "$(pwd):/src" -w /src ghcr.io/abdumajidrashidov/mycop scan .
Fits into your existing workflow
Use mycop in CI, as a git hook, or directly in your editor.
GitHub Action
Add security scanning to your CI pipeline
Pre-commit Hook
Catch issues before they reach the repo
MCP Server New
Agentic security scanning in Claude Code, Cursor, Windsurf
VS Code Extension Coming Soon
Real-time security diagnostics in your editor
100 rules covering OWASP Top 10 & CWE Top 25
50 Python + 50 JavaScript rules, each mapped to CWE identifiers for standards compliance.
| Category | Python | JavaScript |
|---|---|---|
| SQL Injection (CWE-89) | PY-SEC-001, 042 | JS-SEC-011 |
| Command Injection (CWE-78) | PY-SEC-002, 045, 050 | JS-SEC-016 |
| Hardcoded Secrets (CWE-798) | PY-SEC-003, 034, 043 | JS-SEC-004, 034 |
| Insecure Random (CWE-330) | PY-SEC-004 | JS-SEC-005 |
| Eval/Exec Injection (CWE-95) | PY-SEC-005 | JS-SEC-002, 049 |
| Path Traversal / Zip Slip (CWE-22) | PY-SEC-006, 037 | JS-SEC-006, 037 |
| Insecure Deserialization (CWE-502) | PY-SEC-007 | JS-SEC-009 |
| XSS (CWE-79) | PY-SEC-009, 044 | JS-SEC-001, 010, 041 |
| SSRF (CWE-918) | PY-SEC-011 | JS-SEC-007 |
| XXE (CWE-611) | PY-SEC-012 | JS-SEC-012 |
| Template Injection (CWE-1336) | PY-SEC-014 | JS-SEC-013 |
| Weak Crypto (CWE-327/328) | PY-SEC-017–021 | JS-SEC-017–022 |
| Insecure TLS (CWE-295) | PY-SEC-022 | JS-SEC-021 |
| JWT None Alg (CWE-345) | PY-SEC-023 | JS-SEC-023 |
| Open Redirect (CWE-601) | PY-SEC-027 | JS-SEC-027 |
| CORS Misconfiguration (CWE-942) | PY-SEC-028 | JS-SEC-028 |
| Mass Assignment (CWE-915) | PY-SEC-029 | JS-SEC-030 |
| Debug Mode (CWE-215) | PY-SEC-031 | JS-SEC-031 |
| Timing Attack (CWE-208) | PY-SEC-046 | JS-SEC-046 |
| ReDoS (CWE-1333) | PY-SEC-047 | JS-SEC-047 |
… and 20+ more categories. Run mycop rules list for the full list.
|
||
Latest from the blog
Deep dives into AI code security, vulnerability patterns, and how to defend against them.
mycop Now Speaks MCP: Security Scanning Inside Your AI Coding Assistant
mycop 0.3.0 ships with a built-in MCP server. Claude Code, Cursor, Windsurf, and other agentic tools can now scan, fix, and review code for vulnerabilities without leaving the conversation.
The Security Bugs AI Coding Assistants Keep Writing
I analyzed the patterns of security vulnerabilities that AI coding assistants repeatedly introduce — SQL injection, eval(), hardcoded secrets, and more. Real code examples and how to catch them.
Frequently asked questions
What developers ask before adopting a security scanner.
Is AI-generated code safe? What security risks does Copilot and ChatGPT code have?
How do I scan Python or JavaScript code for security vulnerabilities for free?
curl -fsSL https://raw.githubusercontent.com/AbdumajidRashidov/mycop/main/install.sh | sh), then run mycop scan . in your project directory. It finds SQL injection, XSS, hardcoded secrets, and 20+ more vulnerability categories with zero configuration required.How does mycop compare to Semgrep, Bandit, and ESLint for security scanning?
Can I automatically fix security vulnerabilities in my code with AI?
mycop fix command uses AI to automatically rewrite vulnerable code. It groups all findings per file, sends them to your chosen AI provider (Claude, GPT-4, OpenAI, or Ollama), generates a diff for you to review, and re-scans to verify the fix. Use --dry-run to preview changes before applying. No AI key is needed for scanning — only for auto-fix.How do I use mycop with Claude Code, Cursor, or Windsurf?
mycop mcp to start the server, then configure your tool to connect. For Claude Code, add {"mcpServers":{"mycop":{"command":"mycop","args":["mcp"]}}} to your settings. It works with Cursor, Windsurf, Codex CLI, Gemini CLI, and any MCP-compatible client.How do I add security scanning to my CI/CD pipeline or GitHub Actions?
uses: AbdumajidRashidov/mycop/action@main to your workflow to block PRs with high-severity vulnerabilities. It outputs SARIF format for GitHub Code Scanning, works as a pre-commit hook to catch issues before they reach your repo, and supports --diff mode to scan only changed files.