analyzeRepoLABSCO SUMMARY
Scan once, then ask about the results as many times as you like.
Writing every scan to disk and exposing it as a readable resource is what makes this usable in conversation: the expensive step happens once, and the follow-up questions read JSON. Note the metrics default — remote telemetry is on unless you turn it off, which matters if you are scanning a private tree.
What it is
A Go security toolchain that also speaks MCP. It inventories a project's dependencies, checks each one against OSV.dev for known vulnerabilities and malicious packages, and scans the tree for hardcoded secrets using Gitleaks when it is installed or a built-in scanner when it is not. Results are written under gothreatscope_store/ and exposed back as MCP resources, so a follow-up question reads the saved artifact instead of rerunning the scan.
What you get
analyzeRepo— run the whole pipeline, SBOM then vulnerabilities then secrets, in one callscanRepoSBOM— generate a dependency inventory and return the file URI of the resultvulnCheck— check dependencies against OSV.dev for known vulnerabilities and known-malicious packagessecretScan— search the tree for API keys, passwords and private tokens, with the engine selectable between Gitleaks and the built-in scanner- Stored artifacts as MCP resources:
sbom.json,vuln.json,secrets.jsonandmetrics.jsonper project, listed and read through the protocol
Requirements
Nothing — no account, no key. Go 1.21 or newer to install from source with go install, or the included Dockerfile. Gitleaks v8 or newer is optional and only widens secret detection. Start the server with gothreatscope --mcp over stdio; the documented client entry sets GTS_MCP_MODE to reduce output noise. Telemetry goes to a built-in demo endpoint unless you set GOTHREATSCOPE_METRICS_URL or disable it with GTS_DISABLE_METRICS.
Setup effort
One command — go install github.com/anotherik/gothreatscope/cmd/gothreatscope@latest
USE CASES
01
Checking a repository you just cloned
Run the full pipeline over the directory and read back which dependencies are vulnerable and whether any secrets are committed.
02
Finding a leaked credential before it ships
Scan the tree for keys, passwords and tokens, choosing the deeper engine when Gitleaks is available.
03
Checking one dependency set against a live advisory feed
Look up the project's dependencies in OSV.dev to catch both known vulnerabilities and packages flagged as malicious.
4 tools
Listed in project docs. Your client may show a different list.
scanRepoSBOMvulnChecksecretScanBEFORE YOU INSTALL
What to know first
Tools you get
4 tools named in the project's documentation.
Requires
Go 1.21 or later
Where it runs
Both documented setups run the server on your machine.
INSTALLATION
Connect your client
Server setup
TERMINAL
go install github.com/anotherik/gothreatscope/cmd/gothreatscope@latestMCP Clients
Cursor — global
CURSOR — GLOBAL · JSON
{
"mcpServers": {
"gothreatscope": {
"command": "<YOUR_PATH_TO_GOTHREATSCOPE>",
"args": [
"--mcp"
],
"env": {
"GTS_MCP_MODE": "1"
}
}
}
}Cursor — workspace
CURSOR — WORKSPACE · JSON
{
"mcpServers": {
"gothreatscope": {
"command": "./gothreatscope",
"args": [
"--mcp"
],
"env": {
"GTS_MCP_MODE": "1"
}
}
}
}
