English Français العربية

Gadriel AI Security Harness

Official registry Security

AI Security Harness: SAST, secrets, deps, containers, config & OWASP LLM. Scans locally.

Source code Website Documentation

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

NPM package gadriel
Claude Code 
claude mcp add gadriel-ai-security-harness -e 'GADRIEL_NO_ANONYMOUS_AUTH=<GADRIEL_NO_ANONYMOUS_AUTH>' -- npx -y gadriel@1.7.0 code mcp
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "gadriel-ai-security-harness": {
            "command": "npx",
            "args": [
                "-y",
                "gadriel@1.7.0",
                "code",
                "mcp"
            ],
            "env": {
                "GADRIEL_NO_ANONYMOUS_AUTH": "<GADRIEL_NO_ANONYMOUS_AUTH>"
            }
        }
    }
}

Environment variables

  • GADRIEL_NO_ANONYMOUS_AUTH Set to 1 to skip anonymous device registration with app.gadriel.ai.

Documentation

From the project's README on GitHub, refreshed weekly. Links open on GitHub.

Contents
  1. Gadriel — AI Security Harness for GitHub Copilot
  2. Get it
  3. Use
  4. Good to know
  5. Maintainers
  6. License

Gadriel — AI Security Harness for GitHub Copilot

Security scanning for the code Copilot writes: SAST, secrets, dependencies (SCA/SBOM), containers and configuration, including AI-specific risks like prompt injection and the OWASP LLM Top 10 — 3,000+ rules, scanned on your machine. Gadriel plugs into Copilot as an MCP server plus repository instructions, prompts, and reviewer agents.

Part of the Gadriel AI Security Harness, alongside VS Code, Claude Code, Codex, and Cursor.

Get it

Easiest — the VS Code extension. Install **Gadriel AI Security Harness** from the Marketplace. It registers the gadriel MCP server for Copilot automatically and adds a Gadriel: Scan Repository command — no config to edit.

Or add the MCP server yourself. The server is published to the GitHub MCP Registry as io.github.Gadriel-ai/gadriel, so it shows up in VS Code's MCP: Browse Servers and Copilot Chat's @mcp search — add it in a click. To wire it per-repo instead, drop this .vscode/mcp.json into your project (needs Node for npx, or npm install -g gadriel):

{ "servers": { "gadriel": { "type": "stdio", "command": "npx", "args": ["-y", "gadriel@1.7.0", "code", "mcp"] } } }

Add the Copilot guidance (optional). Copy the .github/ directory into your repo so Copilot knows how to use Gadriel:

PathWhat
.github/copilot-instructions.mdrepo-wide guidance, auto-applied
.github/instructions/*.instructions.md17 topic rules, scoped by applyTo
.github/prompts/*.prompt.md/gadriel-scan, /gadriel-fix, /gadriel-status, …
.github/agents/*.agent.md8 reviewer agents

Use

In Copilot Chat (agent mode), just ask: "Run a Gadriel security scan on this repo and summarize the findings," or invoke a prompt like /gadriel-scan. The gadriel MCP tools — validate_file, findings_for_path, fix_finding, validate_buffer, and more — are available to Copilot directly.

Good to know

  • No automatic edit guardrail here. Copilot/VS Code has no edit-time hook (Cursor and Codex do), so scanning runs on request via the MCP tools and prompts rather than blocking each edit.
  • Enterprise: Copilot Business/Enterprise can allowlist the gadriel MCP server through managed MCP policy.
  • Privacy: code is scanned locally and never uploaded. First run registers an anonymous device credential with app.gadriel.ai (a random device id — no hostname, username, or keys); set GADRIEL_NO_ANONYMOUS_AUTH=1 to skip. See the privacy policy.

Maintainers

The registry listing is (re)published by .github/workflows/publish-mcp.yml (GitHub OIDC — an org namespace can only be published from CI in a Gadriel-ai repo). After a new gadriel npm release, bump server.json and the .vscode/mcp.json pin, then re-run that workflow.

License

This repository is Apache-2.0. The gadriel scanner it runs is proprietary, under the Gadriel terms.

Frequently asked questions

What is Gadriel AI Security Harness?

AI Security Harness: SAST, secrets, deps, containers, config & OWASP LLM. Scans locally.

How do I install Gadriel AI Security Harness?

It runs on your machine. In Claude Code: claude mcp add gadriel-ai-security-harness -e 'GADRIEL_NO_ANONYMOUS_AUTH=<GADRIEL_NO_ANONYMOUS_AUTH>' -- npx -y gadriel@1.7.0 code mcp. For other clients, paste the JSON configuration from this page into their MCP settings.

Does Gadriel AI Security Harness need an API key?

Its registry entry lists no required key or secret. Some features may still need an account with the service it connects to.

Is Gadriel AI Security Harness open source?

Yes. Its code is on GitHub under the Apache-2.0 license.

Who maintains Gadriel AI Security Harness?

It is published by Gadriel-ai. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.