Scanner built from 10,659 public MCP configs audits AI codebases with zero upload
Lopsided_Sign1696 · reddit · 2026-11-14
Built from analysis of 10,659 public MCP configs, RepoXray (npm: rxray) is an open-source security/supply-chain/LLM-context scanner for AI-assisted codebases. The isomorphic TypeScript engine runs 100% client-side in an isolated Web Worker (zero bytes uploaded) or as a 20KB zero-dependency CLI (npx rxray .), signed with SLSA OIDC provenance.
Key capabilities:
- Supply-chain & AI slopsquatting defense: batch CVE audits via Google OSV.dev, exact lockfile resolution, detection of hallucinated unregistered (404) packages, npm 0.0.1-security tombstones, malicious postinstall hooks
- Empirical MCP config auditing: wrong-registry MCP calls (uvx vs npm), vendor scope impersonation (@anthropic/ vs @anthropic-ai/), unpinned Git installs, plaintext secrets in env blocks
- Secret & SAST scanning: high-precision regexes + Shannon entropy filtering with auto-redaction; static checks for SQL template injection, unsafe shell interpolation, dynamic eval
- Deterministic AI guardrail compiler: quantifies LLM token waste, generates tailored .aiignore and AGENTS.md, plus a <1s offline Git pre-commit gate
1,160+ npm downloads in the first 48 hours; MIT-licensed on npm and GitHub Marketplace.
More from coding & agent
- Solo dev builds real-time conference translation platform for 70 languages with an agentic harness — evisoft · 2026-11-14
- Open-source Blender add-on runs NVIDIA Kimodo, ARDY and MotionBricks locally for AI motion generation — bdsqlsz · 2026-11-14
- TestPrune: pruning regression tests to unblock AI-driven autonomous bug fixing — burkov · 2026-11-14
- Context beats model choice: Databricks benchmark shows 91% vs 58% for data agents — CautiousUse8597 · 2026-11-14
- Developer skips localhost entirely: prompts go straight to production with AI agent safeguards — marclou · 2026-11-14
- HeyGen MCP demo: one ChatGPT prompt books tickets and sends an avatar birthday video — toolstelegraph · 2026-11-14