scanLABSCO SUMMARY
Scanning needs no key and no network; only the AI review does.
The rules are compiled in, so the base scan works on an air-gapped machine and produces the same result every time. That also fixes the usual awkwardness of scanner-plus-agent: findings carry a fix hint, so the agent that just called scan can apply the change itself instead of routing through another model. Inline # mycop-ignore comments suppress a specific rule when a finding is genuinely fine.
What it is
A Rust security scanner aimed at the patterns LLMs produce most often, with an MCP server built in. All 200 rules are compiled into the binary, covering OWASP Top 10 and CWE Top 25 across Python, JavaScript, TypeScript, Go and Java, so a scan needs no registry, no config file and no internet connection.
What you get
scanchecks files or directories for vulnerabilities, with severity filteringlist_rulesbrowses and filters the 200 built-in rulesexplain_findinggives a detailed explanation of one finding with its CWE and OWASP contextreviewruns a deep AI security review of a file, looking for logic flaws and race conditions beyond rule matchingcheck_depsdetects hallucinated packages in your dependencies- Findings carry a fix hint, so in MCP mode the agent applies the fix itself rather than making a second AI call
- Two resources:
mycop://rules/catalogfor the full JSON catalogue andmycop://config/schemafor a config template
Requirements
The binary — install with the shell script, brew install AbdumajidRashidov/tap/mycop, cargo install mycop, or the ghcr.io container image. Register it as mycop with the argument mcp. Scanning needs nothing else. The AI-backed paths (review, explanations, and the mycop fix CLI command) auto-detect a provider in order: the Claude CLI, ANTHROPIC_API_KEY, OPENAI_API_KEY, a local Ollama server on port 11434, then a rule-based offline fallback that uses the fix hints. Configure ignores and thresholds in .scanrc.yml, generated by mycop init.
Setup effort
One command — curl -fsSL https://raw.githubusercontent.com/AbdumajidRashidov/mycop/main/install.sh | sh
USE CASES
01
Checking code an assistant just wrote
Scan the changed files before the commit, filtered to high and critical.
02
Understanding a finding you do not recognise
Ask for the explanation with its CWE and OWASP context rather than searching the rule id.
03
Fixing what the scan found
Let the agent read the findings and their fix hints and apply the changes directly.
04
Catching a package that does not exist
Check dependencies for hallucinated names before they reach a lockfile.
05
Going deeper than pattern matching
Run the AI review on one file to look for logic flaws and race conditions.
5 tools
Listed in project docs. Your client may show a different list.
list_rulesexplain_findingreviewcheck_depsBEFORE YOU INSTALL
What to know first
Tools you get
5 tools named in the project's documentation.
Requires
mycop on PATH
Where it runs
All 3 documented clients run the server on your machine.
INSTALLATION
Connect your client
Server setup
TERMINAL
curl -fsSL https://raw.githubusercontent.com/AbdumajidRashidov/mycop/main/install.sh | shMCP Clients
Claude Code, Windsurf
JSON
{
"mcpServers": {
"mycop": {
"command": "mycop",
"args": [
"mcp"
]
}
}
}Cursor
CURSOR · JSON
{
"mcpServers": {
"mycop": {
"command": "mycop",
"args": [
"mcp"
],
"type": "stdio"
}
}
}
