aegisq-codeshield-mcp

AI security scanning for your coding tools — powered by the Model Context Protocol.

AegisQ-CodeShield scans AI-generated code in real-time for OWASP Top 10, OWASP LLM Top 10, CISA Secure by Design, and CWE vulnerabilities. It works inside your favorite AI coding tool via MCP.

Supported Tools

| Tool | Transport | Config Location | |------|-----------|-----------------| | Claude Code | stdio | ~/.claude/mcp.json | | Cursor | stdio | .cursor/mcp.json | | Windsurf | stdio | MCP settings | | GitHub Copilot | stdio | VS Code settings | | Cline | stdio | MCP settings | | Continue.dev | stdio | MCP settings | | Zed | stdio | settings.json | | ChatGPT | HTTP | http://localhost:3100/mcp | | Codex CLI | stdio | MCP config |

Quick Start

1. Install

npx aegisq-codeshield-mcp --help

Requires Node.js 18+.

v2.0.x: HTTP transport (--http) requires Authorization: Bearer <token> on every /mcp request. The server auto-generates a 256-bit token on first launch (stored at ~/Library/Application Support/AegisQ-CodeShield/auth-token on macOS, ~/.config/aegisq-codeshield/auth-token on Linux, 0600 perms). Set your own with AEGISQ_AUTH_TOKEN. Stdio users (Claude Code, Cursor, Windsurf, Cline, Continue.dev, Zed) are unaffected. See License & Support below for help.

2. Configure Your Tool

Claude Code / Cursor / Windsurf — add to your MCP config:

{
  "mcpServers": {
    "aegisq-codeshield": {
      "command": "npx",
      "args": ["aegisq-codeshield-mcp"],
      "env": {
        "AEGISQ_LICENSE_KEY": "your-license-key"
      }
    }
  }
}

ChatGPT / HTTP-based tools — start the HTTP server:

AEGISQ_LICENSE_KEY=your-key npx aegisq-codeshield-mcp --http

Then connect your tool to http://localhost:3100/mcp.

3. Scan

Ask your AI coding tool:

"Scan this file for security vulnerabilities"

MCP Tools

| Tool | Description | |------|-------------| | aegisq_scan_file | Scan a file for security vulnerabilities | | aegisq_scan_snippet | Scan inline or generated code snippets | | aegisq_explain | AI-powered vulnerability explanation | | aegisq_fix | Auto-fix generation with diff preview | | aegisq_report | Compliance report (OWASP/CISA/CWE) in Markdown, JSON, or CSV | | aegisq_status | Server status, license tier, scan count |

Features

• 80+ security rules covering injection, auth, crypto, LLM prompt injection, and more
• LLM-powered deep scanning beyond regex patterns (Pro+)
• Auto-fix generation with one-click remediation (Pro+)
• Compliance reports grouped by OWASP, CISA, or CWE
• Works offline — regex engine runs locally with zero network calls
• Inline suppression — add // aegisq-ignore to skip specific lines

CLI Options

aegisq-codeshield-mcp [options]

Options:
  --http        Start HTTP server (default: stdio)
  --port PORT   HTTP port (default: 3100)
  --host HOST   HTTP bind address (default: 127.0.0.1)
  --stateless   Stateless HTTP mode
  --help        Show help

Environment Variables

| Variable | Description | |----------|-------------| | AEGISQ_LICENSE_KEY | Your license key | | AEGISQ_LLM_API_KEY | LLM API key (Anthropic, OpenAI, or compatible provider) | | AEGISQ_LLM_PROVIDER | LLM provider: anthropic (default), openai, openai-compatible | | AEGISQ_LLM_MODEL | Model override (e.g. gpt-4o, claude-sonnet-4-5) | | AEGISQ_LLM_BASE_URL | OpenAI-compatible base URL (Groq, OpenRouter, Ollama, etc.) | | AEGISQ_TRANSPORT | Transport mode: stdio or http | | AEGISQ_PORT | HTTP port (default: 3100) | | AEGISQ_HOST | HTTP bind address (default: 127.0.0.1) |

License Tiers

| Tier | Price | LLM Scans | Fixes | Sessions | |------|-------|-----------|-------|----------| | Free | $0 | 5/day | 3/day | 1 | | Pro | $19/mo | Unlimited | Unlimited | 5 | | Team | $49/mo | Unlimited | Unlimited | 25 | | Enterprise | Custom | Unlimited | Unlimited | Unlimited |

The free tier includes all regex-based scanning (80+ rules) with no limits.

License & Support

MIT.

Need help, have a bug to report, or want to talk pricing?

• Email: [email protected]
• Security disclosures: also [email protected] — please use the subject line [SECURITY] AegisQ-CodeShield

Links

• VS Code Extension (free base scanner)
• npm: @aegisq-codeshield/core — embeddable scanning engine
• npm: @aegisq-codeshield/security-rules — standalone rule definitions