@opzyai/mcp

A local-first security check for AI coding agents. An MCP server that scans the project in your workspace for the mistakes that ship secrets and vulnerabilities to production — and runs entirely on your machine.

Ask your agent "is this safe to ship?" and get a Launch Readiness score with a fix for every finding.

Built by Opzyai — source at thfothijn/opzyai-mcp. For deep, server-side scanning of repositories you own (SAST, dependency CVEs, git-history secrets) and fixes your AI editor applies for you, see the hosted Pro server.

What it checks

The single security_check tool runs four detectors over your project:

• Hardcoded secrets — API keys, tokens and credentials in your working tree (OpenAI, Anthropic, Stripe, Supabase service-role, AWS, GitHub and more).
• Exposed .env files — env files that are committed or not gitignored.
• Secrets in git history — credentials that were committed and later "removed" (but are still in the history).
• Vulnerable dependencies — known-vulnerable packages, checked against OSV (package-lock.json, pnpm-lock.yaml and yarn.lock supported).

Example output

Launch Readiness: 35/100 — not safe to ship yet.

Findings (2), most severe first:

[CRITICAL] Stripe live secret key in source
  Where: src/lib/billing.ts:12
  Why:   sk_live_… assigned to a constant that ships to production
  Fix:   Move it to an environment variable and rotate the key in the Stripe dashboard.

[HIGH] .env is not gitignored
  Where: .env
  Why:   the file with your real credentials can be committed by any `git add .`
  Fix:   Add `.env` to .gitignore and rotate anything already committed.

Dependency check used OSV.dev — only package names + versions were sent, never your code.
Ran entirely on your machine.

Privacy

Everything runs locally over stdio. The only network call is the dependency check (OSV), which sends package names + versions only — never your code. Pass offline: true to skip it so nothing leaves your machine at all.

Install

No global install needed — run it on demand with npx.

Claude Code

claude mcp add opzyai -- npx -y @opzyai/mcp

Cursor / generic MCP client

{
  "mcpServers": {
    "opzyai": {
      "command": "npx",
      "args": ["-y", "@opzyai/mcp"]
    }
  }
}

Then ask your agent: "run a security check on this project" or "is this safe to ship?"

Tool reference

security_check

| Input | Type | Description | | --------- | --------- | -------------------------------------------------------------------- | | path | string? | Project root to scan. Defaults to the current working directory. | | offline | boolean?| Skip the OSV dependency check so nothing leaves the machine. |

Free URL scan

Not sure what your deployed app exposes? Run the free, no-account Vibe Check — paste your URL, get a 0–100 Launch Readiness score in ~15 seconds (leaked keys in the client bundle, exposed .env / .git / source maps, missing headers).

Requirements

• Node.js >= 20
• git on PATH (for the git-history check)

License

MIT © Opzyai