Loading repository data…
Loading repository data…
nebumohan / repository
AI-powered vulnerability scanner integrating Bandit, Semgrep, Google Gemini, and MCP for intelligent security detection and remediation.
A transparent discovery signal based on current public GitHub metadata.
This score does not audit code, security, maintainers, documentation quality, or suitability. Verify the repository and its current documentation before adoption.
A custom static application security testing (SAST) tool that combines traditional scanners with AI-driven analysis, integrated with Claude Desktop via Model Context Protocol (MCP) for real-time, conversational security scanning.
This project is an AI-enhanced vulnerability scanner designed to simulate a real-world SOC/DevSecOps workflow.
It integrates:
Goal: Bridge the gap between automated detection and developer-friendly remediation, accessible directly from a conversational AI interface, and grounded in how a SOC actually thinks about attacker behavior.
+-------------------------+
| Claude Desktop (MCP) |
| "scan this file..." |
+----------+--------------+
|
+------v------+
| mcp_server |
| .py |
+------+------+
|
+-----+-----+
| |
+----v----+ +----v----+
| Bandit | | Semgrep |
| (SAST) | |(Patterns|
+----+----+ +----+----+
| |
+-----+-----+
|
+------v------+
| Gemini AI |
| Risk Score |
| Fix Advice |
+------+------+
|
+------v------+
| ATT&CK Map |
| (T1059 etc) |
+------+------+
|
+------v------+
| SQLite DB |
+------+------+
|
+------v------+
| HTML Report |
| (Jinja2) |
+-------------+
There are two entry points into this pipeline. The MCP server (mcp_server.py) is the conversational path, ask Claude Desktop to scan a file, get a report back inline. The standalone scanner (src/analyzer.py) is the batch path, point it at a folder, get an HTML report with everything stored in SQLite, including the ATT&CK mapping.
ai-vuln-scanner/
├── mcp_server.py # MCP server, exposes scanner as a Claude Desktop tool
├── src/
│ └── analyzer.py # standalone scanner: detection, Gemini analysis, ATT&CK mapping, report generation
├── templates/
│ └── report.html # Jinja2 HTML report template
├── reports/
│ └── report.html # generated output
├── test_apps/
│ └── vuln_app.py # sample vulnerable app used for testing
├── screenshots/
├── findings.db # SQLite scan history (not committed, see .gitignore)
├── requirements.txt
└── README.md
Simply open Claude Desktop and type:
scan this file: /Users/nebumohan/Desktop/ai-vuln-scanner/test_apps/vuln_app.py
Claude invokes the scan_file MCP tool, which runs Bandit and Semgrep concurrently, sends both sets of findings plus the source code to Gemini, and returns a full triage report inline in the conversation.
Gemini takes the raw Bandit and Semgrep findings and returns a plain-English explanation of each vulnerability, a CVSS-like severity rating, precise fix recommendations per finding, and flags anything that looks like a false positive from the automated tools.
The standalone scanner ties each detected issue to the ATT&CK technique it would enable if exploited, rather than leaving the finding as an isolated label.
| Finding | Technique | Why |
|---|---|---|
eval() usage | T1059 — Command and Scripting Interpreter | Executes arbitrary strings as code, the same outcome an attacker gets from a scripting interpreter |
os.system() | T1059 — Command and Scripting Interpreter | Directly invokes a shell command |
subprocess usage | T1059 — Command and Scripting Interpreter | Can spawn a shell process if user input reaches it unsanitized |
These mappings were reasoned through using CISA's Decider methodology, which works through a guided set of questions to land on a technique rather than guessing from the technique name alone. As more detection patterns get added, this table grows alongside them.
vuln_app.py)| Priority | Vulnerability | Line | Severity | Fix |
|---|---|---|---|---|
| 🔴 Fix Now | SSL verification disabled | 24 | Critical | Remove verify=False |
| 🔴 Fix Now | Weak MD5 hashing | 22 | High | Use hashlib.scrypt or bcrypt |
| 🔴 Fix Now | eval() usage | 8 | High | Replace with ast.literal_eval() |
| 🟠 Fix Soon | Hardcoded password | 19 | Medium | Use env vars or secrets manager |
| 🟠 Fix Soon | subprocess with shell=True | 12, 16 | Medium | Use list args + shell=False |
| 🟡 Fix Later | HTTP instead of HTTPS | 24 | Low | Switch to https:// |
| 🟡 Fix Later | No request timeout | 24 | Low | Add timeout= parameter |
| 🟡 Fix Later | Partial executable path | 12, 16 | Low | Use absolute paths |
| Layer | Technology |
|---|---|
| Language | Python 3.13 |
| SAST | Bandit, Semgrep |
| AI Analysis | Google Gemini API |
| Threat Mapping | MITRE ATT&CK, validated via CISA Decider |
| MCP Integration | mcp Python SDK |
| Database | SQLite |
| Reporting | Jinja2 HTML |
| Version Control | Git |
git clone https://github.com/nebumohan/ai-vuln-scanner.git
cd ai-vuln-scanner
pip install -r requirements.txt
Create a .env file:
GEMINI_API_KEY=your_api_key_here
Add this to ~/.config/claude/claude_desktop_config.json:
{
"mcpServers": {
"ai-vulnerability-scanner": {
"command": "python3",
"args": ["/Users/nebumohan/Desktop/ai-vuln-scanner/mcp_server.py"],
"env": {
"GEMINI_API_KEY": "your_api_key_here"
}
}
}
}
Restart Claude Desktop after saving.
python src/analyzer.py
This scans the test_apps folder by default, runs Bandit and Semgrep across it, checks each file for eval, os.system, and subprocess usage, maps each finding to its ATT&CK technique, and writes the report to reports/report.html.
Most SAST tools detect vulnerabilities but leave developers without context. This scanner detects issues via Bandit and Semgrep static analysis, explains them via Gemini AI in plain English, ties each one to a known attacker technique via ATT&CK mapping, prioritizes them with severity triage and fix urgency, and integrates directly into Claude Desktop via MCP.
It's meant to simulate the kind of AI-augmented security tooling being adopted in modern SOC and DevSecOps pipelines, where the value isn't just finding the issue but explaining why it matters and how an attacker would actually use it.