The rules are compiled in, so the base scan works on an air-gapped machine and produces the same result every time. That also fixes the usual awkwardness of scanner-plus-agent: findings carry a fix hint, so the agent that just called `scan` can apply the change itself instead of routing through another model. Inline `# mycop-ignore` comments suppress a specific rule when a finding is genuinely fine.
A Rust security scanner aimed at the patterns LLMs produce most often, with an MCP server built in. All 200 rules are compiled into the binary, covering OWASP Top 10 and CWE Top 25 across Python, JavaScript, TypeScript, Go and Java, so a scan needs no registry, no config file and no internet connection.
- `scan` checks files or directories for vulnerabilities, with severity filtering
- `list_rules` browses and filters the 200 built-in rules
- `explain_finding` gives a detailed explanation of one finding with its CWE and OWASP context
- `review` runs a deep AI security review of a file, looking for logic flaws and race conditions beyond rule matching
- `check_deps` detects hallucinated packages in your dependencies
- Findings carry a fix hint, so in MCP mode the agent applies the fix itself rather than making a second AI call
- Two resources: `mycop://rules/catalog` for the full JSON catalogue and `mycop://config/schema` for a config template
The binary — install with the shell script, `brew install AbdumajidRashidov/tap/mycop`, `cargo install mycop`, or the ghcr.io container image. Register it as `mycop` with the argument `mcp`. Scanning needs nothing else. The AI-backed paths (`review`, explanations, and the `mycop fix` CLI command) auto-detect a provider in order: the Claude CLI, `ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, a local Ollama server on port 11434, then a rule-based offline fallback that uses the fix hints. Configure ignores and thresholds in `.scanrc.yml`, generated by `mycop init`.
One command — curl -fsSL https://raw.githubusercontent.com/AbdumajidRashidov/mycop/main/install.sh | sh