[Security Layer] Security Scanner & Vulnerability Detection

[gloomcheng]

Problem

Only basic pattern matching for security, no:

• Dependency vulnerability scanning
• Secret detection (API keys, tokens)
• OWASP Top 10 checks
• Security best practices enforcement

Developer Pain Points

• Secrets accidentally committed
• Vulnerable dependencies not caught
• No security validation before commit
• Manual security reviews required

Proposed Solution

Security Scanner Service with:

1. npm audit / trivy integration
2. Entropy-based secret detection
3. Security pattern library
4. SAST (Static Application Security Testing)

Features

• Scan dependencies for CVEs
• Detect secrets (high entropy strings, patterns)
• Check for SQL injection, XSS, CSRF
• Validate input sanitization

MCP Tools

• security-scan: Scan files for security issues
• security-check-deps: Check dependency vulnerabilities
• security-detect-secrets: Find potential secrets

Priority

High - Security compliance

Effort Estimate

3 days