English Français العربية

AI Scanner

Official registry Developer tools

Scan codebases for LLM/AI SDK usage, exposed API tokens, and hardcoded secrets.

Source code Documentation

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

NPM package ai-scanner-mcp
Claude Code 
claude mcp add ai-scanner -- npx -y ai-scanner-mcp@1.0.3
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "ai-scanner": {
            "command": "npx",
            "args": [
                "-y",
                "ai-scanner-mcp@1.0.3"
            ]
        }
    }
}

Documentation

From the project's README on GitHub, refreshed weekly. Links open on GitHub.

Contents
  1. ai-scanner-mcp
  2. Tools
  3. Setup
  4. Example Usage
  5. Tool Details
  6. Detection Coverage
  7. License

ai-scanner-mcp

MCP server for ai-scanner - let AI agents scan codebases for LLM usage, AI frameworks, and exposed secrets.

An MCP server that exposes ai-scanner as tools for AI agents. Works with Claude Code, Claude Desktop, Cursor, Windsurf, and any MCP-compatible client.

Tools

ToolDescription
scan_directoryFull scan — LLM SDKs, AI frameworks, exposed tokens, and hardcoded secrets with severity levels
check_secretsSecurity check — pass/fail scan for exposed credentials only. Perfect for pre-commit checks
ai_inventoryAI stack overview — which SDKs, frameworks, models, and API endpoints are used (no secret detection)

Setup

Claude Code
claude mcp add ai-scanner npx ai-scanner-mcp
Claude Desktop

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "ai-scanner": {
      "command": "npx",
      "args": ["ai-scanner-mcp"]
    }
  }
}

Config file location:

  • macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
  • Windows: %APPDATA%\Claude\claude_desktop_config.json
Cursor

Add to .cursor/mcp.json in your project:

{
  "mcpServers": {
    "ai-scanner": {
      "command": "npx",
      "args": ["ai-scanner-mcp"]
    }
  }
}
Windsurf

Add to ~/.windsurf/mcp.json:

{
  "mcpServers": {
    "ai-scanner": {
      "command": "npx",
      "args": ["ai-scanner-mcp"]
    }
  }
}

Example Usage

Once connected, you can ask your AI agent:

  • "Scan this project for any exposed API keys"
  • "Check if there are any hardcoded secrets before I commit"
  • "What AI SDKs and frameworks does this codebase use?"
  • "Run a security scan on ./src and tell me if it's safe to push"
  • "Give me an AI inventory of this project"

Tool Details

scan_directory

Full scan with all detection categories. Parameters:

ParameterTypeDefaultDescription
directorystringrequiredPath to scan
ai_onlybooleanfalseSkip generic secrets (Stripe, GitHub, etc.)
scan_envbooleanfalseInclude .env files
include_endpointsbooleantrueDetect LLM API endpoint URLs
include_modelsbooleantrueDetect model name references
check_secrets

Security-focused pass/fail check. Parameters:

ParameterTypeDefaultDescription
directorystringrequiredPath to scan
ai_onlybooleanfalseOnly check AI tokens
scan_envbooleanfalseInclude .env files
ai_inventory

AI stack awareness (no secret detection). Parameters:

ParameterTypeDefaultDescription
directorystringrequiredPath to scan

Detection Coverage

  • AI Tokens (20+) — OpenAI, Anthropic, Google, AWS, HuggingFace, Groq, Replicate, and more
  • Generic Secrets (59) — Stripe, Twilio, GitHub, Slack, Discord, database URIs, private keys, JWTs
  • LLM SDKs (23) — OpenAI, Anthropic, Google Gemini, LiteLLM, AWS Bedrock, and more
  • AI Frameworks (24) — LangChain, LlamaIndex, CrewAI, AutoGen, DSPy, Vercel AI SDK, and more
  • 145 total detection patterns

License

MIT

Frequently asked questions

What is AI Scanner?

Scan codebases for LLM/AI SDK usage, exposed API tokens, and hardcoded secrets.

How do I install AI Scanner?

It runs on your machine. In Claude Code: claude mcp add ai-scanner -- npx -y ai-scanner-mcp@1.0.3. For other clients, paste the JSON configuration from this page into their MCP settings.

Does AI Scanner need an API key?

Its registry entry lists no required key or secret. Some features may still need an account with the service it connects to.

Is AI Scanner open source?

Yes. Its code is on GitHub under the MIT license.

Who maintains AI Scanner?

It is published by Aakashbhardwaj27. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.