Writing every scan to disk and exposing it as a readable resource is what makes this usable in conversation: the expensive step happens once, and the follow-up questions read JSON. Note the metrics default — remote telemetry is on unless you turn it off, which matters if you are scanning a private tree.
A Go security toolchain that also speaks MCP. It inventories a project's dependencies, checks each one against OSV.dev for known vulnerabilities and malicious packages, and scans the tree for hardcoded secrets using Gitleaks when it is installed or a built-in scanner when it is not. Results are written under `gothreatscope_store/` and exposed back as MCP resources, so a follow-up question reads the saved artifact instead of rerunning the scan.
- `analyzeRepo` — run the whole pipeline, SBOM then vulnerabilities then secrets, in one call
- `scanRepoSBOM` — generate a dependency inventory and return the file URI of the result
- `vulnCheck` — check dependencies against OSV.dev for known vulnerabilities and known-malicious packages
- `secretScan` — search the tree for API keys, passwords and private tokens, with the engine selectable between Gitleaks and the built-in scanner
- Stored artifacts as MCP resources: `sbom.json`, `vuln.json`, `secrets.json` and `metrics.json` per project, listed and read through the protocol
Nothing — no account, no key. Go 1.21 or newer to install from source with `go install`, or the included Dockerfile. Gitleaks v8 or newer is optional and only widens secret detection. Start the server with `gothreatscope --mcp` over stdio; the documented client entry sets `GTS_MCP_MODE` to reduce output noise. Telemetry goes to a built-in demo endpoint unless you set `GOTHREATSCOPE_METRICS_URL` or disable it with `GTS_DISABLE_METRICS`.
One command — go install github.com/anotherik/gothreatscope/cmd/gothreatscope@latest