SafeWeave

SafeWeave

Security scanner for AI-written code. SafeWeave runs inside your AI editor over MCP (Claude Code, Cursor, VS Code, Windsurf) and checks your code for vulnerabilities, leaked secrets, risky dependencies, IaC and container issues, so your assistant can fix findings in the same turn.

• npm: safeweave-mcp
• Official MCP Registry: dev.safeweave/safeweave
• Website: safeweave.dev · try a scan without signing up at safeweave.dev/scan

This repository is the open-core part of SafeWeave: the scanner engines (packages/scanners), the scan gateway (packages/gateway), shared types (packages/common), Docker files and the Claude Code skill. The MCP server itself ships on npm.

Quick Start

Run one command. It downloads the scanners and configures every editor it finds:

npx -y safeweave-mcp

Or add it to your editor's MCP config yourself:

{
  "mcpServers": {
    "safeweave": {
      "command": "npx",
      "args": ["-y", "safeweave-mcp"],
      "env": {
        "SAFEWEAVE_LICENSE_KEY": "your-license-key-here"
      }
    }
  }
}

The key is optional. Without one you get a 10-scan trial (SAST, secrets and dependencies). A free account at safeweave.dev/signup unlocks unlimited local scans with 7 scanners.

Plans

Plan	Price	Where scans run	Scanners
No key	Free	Local, 10-scan trial	3 (SAST, secrets, dependencies)
Free account	Free	Local	7 (everything except DAST)
Cloud	$29/mo	Local + hosted	All 8, plus PR checks, website scans and AI-builder rules
Cloud Plus	$59/mo	Local + hosted	All of Cloud, plus teammates

See safeweave.dev/pricing for details.

Alternative: Docker

If you prefer running via Docker:

git clone https://github.com/nickfluxk/safeweave.git
cd safeweave
cp .env.example .env   # Edit with your license key and SCAN_DIR
docker compose up

How Scanner Binaries Work

SafeWeave automatically downloads and manages the scanner binaries it needs on first use.

Tool	Version	Purpose
gitleaks	8.21.2	Secret and credential detection
trivy	0.58.0	Container vulnerability and IaC misconfiguration scanning
opengrep	1.16.3	SAST analysis (Semgrep-compatible, standalone binary)

• Binaries are resolved in order: system PATH → ~/.safeweave/bin/ cache → auto-download
• If you already have gitleaks or trivy installed via Homebrew/apt, those are used (never shadowed)
• For SAST, system semgrep is preferred; if not found, opengrep (a standalone Semgrep-compatible fork) is downloaded — no Python required
• Downloads happen in the background at startup — the server is ready immediately
• Versions are pinned and updated with each SafeWeave release
• If a download fails (no internet), that scanner is skipped gracefully

Supported platforms: macOS (arm64, x64), Linux (arm64, x64), Windows (x64)

Cache location:

~/.safeweave/
  bin/       # Downloaded binaries
  meta/      # Version metadata (JSON)

To force a re-download: rm -rf ~/.safeweave/bin ~/.safeweave/meta

What's Included

Scanner	What it detects	Plan
SAST	SQL injection, XSS, SSRF, path traversal, insecure crypto	Free
Secrets	API keys, tokens, passwords and private keys in source	Free
Dependencies	Known CVEs in npm, pip, Go and Cargo packages	Free
IaC	Terraform, Dockerfile and Kubernetes misconfigurations	Free account
Container	Vulnerabilities in container images	Free account
License	GPL, AGPL and other risky dependency licenses	Free account
Posture	Missing auth, rate limiting, CORS and security headers	Free account
DAST	Runtime API security issues in a running app	Cloud

MCP Integration

Works with any MCP-compatible editor — Cursor, Claude Code, VS Code, Windsurf, and more.

Once configured (see Quick Start above), ask your AI:

• "Scan this project for security vulnerabilities"
• "Check my dependencies for CVEs"
• "Scan for hardcoded secrets"
• "Run an IaC misconfiguration scan"

If running via Docker, use the SSE transport instead:

{
  "mcpServers": {
    "safeweave": {
      "url": "http://localhost:9000/sse"
    }
  }
}

HTTP API

Health Check

curl http://localhost:9000/api/health

Run a Scan

curl -X POST http://localhost:9000/api/scan \
  -H 'Content-Type: application/json' \
  -d '{"directory": "/path/to/project"}'

Scan Specific Scanners

curl -X POST http://localhost:9000/api/scan \
  -H 'Content-Type: application/json' \
  -d '{"directory": "/path/to/project", "scanners": ["sast", "secrets"]}'

Compliance Profiles

Built-in profiles: standard, hardened, owasp, soc2, pci-dss, hipaa

Set via MCP set_profile tool or create a custom .safeweave/profile.yaml in your project.

Configuration

Environment Variables

Variable	Required	Description
SAFEWEAVE_LICENSE_KEY	No	Your license key from safeweave.dev. Without it: a 10-scan trial
SCAN_DIR	Docker only	Host directory to mount for scanning
SAFEWEAVE_LICENSE_URL	No	License server URL (defaults to https://license.safeweave.dev)

Claude Code Skill: Auto-Scan Before Push

SafeWeave includes a Claude Code skill that automatically scans your code before every git commit, git push, or PR creation.

Install the skill

Copy the skill to your Claude Code skills directory:

mkdir -p ~/.claude/skills/secure-before-push
curl -sL https://raw.githubusercontent.com/nickfluxk/safeweave/main/skills/secure-before-push/SKILL.md \
  -o ~/.claude/skills/secure-before-push/SKILL.md

Or clone and copy:

git clone https://github.com/nickfluxk/safeweave.git /tmp/safeweave
cp -r /tmp/safeweave/skills/secure-before-push ~/.claude/skills/

What happens after install

Once installed, Claude Code automatically runs a SafeWeave scan whenever you say "commit", "push", "ship it", or "create a PR":

Severity	Action	Blocks push?
Critical / High	Fix immediately, re-scan	Yes
Medium	Warns, asks confirmation	User decides
Low / Info	No action	No

Prerequisites

SafeWeave MCP server must be configured. Run npx safeweave-mcp to set it up automatically.

Verify

Start a new Claude Code session and ask it to commit code. You should see a SafeWeave scan run before the git operation.

License

MIT. See LICENSE.