The Problem

We scanned 10,397 AI agent skills and found security issues in 31% of them. Our research identified 859 known-malicious signatures, 500+ remote code execution patterns, and 536 agent identity file modifications, including:

• Credential harvesting (AWS keys, SSH keys, API tokens in configs)
• Tool poisoning (hidden Unicode, prompt override in descriptions)
• Data exfiltration (base64+fetch, webhook, file upload patterns)
• Agent identity spoofing (SOUL.md, AGENTS.md modification without authorization)

Static analysis catches known patterns. Runtime monitoring catches the rest.

Quick Start

# Zero-install (recommended)
npx firmis-cli scan

# Or install globally
npm install -g firmis-cli
firmis scan

# Scan specific platform
firmis scan --platform claude

# Output as JSON for CI/CD
firmis scan --json --output report.json

# Output as SARIF for GitHub Security
firmis scan --sarif --output results.sarif

Pro and Business include a 14-day free trial.

What's New (2026.1.4)

• Credential Shield — Deterministic credential/PII redaction across three layers: log redaction (all events), outbound blocking (p18 rule blocks credential values in tool calls to untrusted destinations), and MCP proxy response redaction (strips credentials before they reach the agent API). 12 patterns, 0.03% FP rate on 7,994 real payloads.
• Agent posture signals — Scan output now includes platform-aware guidance for coding agents: fix decisions (agent-fixable vs human-required), protected files, finding clusters, and environment posture for Claude Code, Cursor, Codex, OpenClaw, and Hermes.
• Live supply chain detection — deps.dev typosquatting detection and OpenSSF Scorecard integration replace static blocklists. OSV now extracts fix versions and aliases.
• Parallelized scanning — OSV vulnerability scan runs in parallel with platform scanning (~3s faster).
• Runtime behavioral monitor — Watches agent tool calls as they happen. Audit-only on Free; active blocking on Pro. Three modes: passive, active, audit-only.
• Command intent classifier — Classifies shell commands by intent using AST analysis, catching threats that static regex cannot.
• Learned trust model — Adapts to your project's workflow over time. Reduces false positives automatically.

What is Firmis?

Firmis is the security layer for AI agents. It analyzes the code of MCP servers, Claude skills, Codex plugins, and other AI agent tools BEFORE you install them — detecting credential harvesting, data exfiltration, prompt injection, tool poisoning, and 17 other threat categories.

Who is it for? Developers using AI coding assistants (Claude Code, Cursor, Codex) who install MCP servers and agent skills. Security teams evaluating AI agent deployments. CI/CD pipelines that need to gate on security.

How is it different from mcp-scan? Firmis is platform-agnostic with built-in analyzers for Claude, MCP, Codex, Cursor, CrewAI, AutoGPT, OpenClaw, Nanobot, and Supabase — not just MCP. It has 270+ rules (not just config checks), and includes runtime monitoring, penetration testing, and remediation intelligence for your coding agent.

Features

| Capability | Command | Tier | |-----------|---------|------| | Scan for threats (295 rules, 21 categories) | firmis scan | Free | | Discover AI agent platforms | firmis discover | Free | | Generate Agent BOM (CycloneDX) | firmis bom | Free | | CI/CD pipeline with fail gates | firmis ci | Free | | HTML/JSON/SARIF reports | firmis scan --html | Free | | Initialize project config | firmis init | Free | | Runtime monitor — audit-only (24h history) | firmis monitor | Free | | Runtime monitor — detect + block (7-day history) | firmis monitor | Pro | | Runtime monitor — detect + block + enforce policies (90-day history) | firmis monitor | Business | | Behavioral engine (anomaly detection, adaptive trust) | firmis monitor | Pro | | Auto-fix threats | firmis fix | Pro | | MCP penetration testing | firmis pentest | Business | | Compliance evidence (ISO 42001, EU AI Act) | firmis compliance | Business |

Supported Platforms

| Platform | Config Location | Support | |----------|-----------------|---------| | Claude Code Skills | ~/.claude/skills/ | Full | | MCP Servers | ~/.config/mcp/, claude_desktop_config.json | Full | | OpenAI Codex Plugins | ~/.codex/plugins/ | Full | | Cursor Extensions | ~/.cursor/extensions/ | Full | | CrewAI Agents | Project crew.yaml, agents.yaml | Full | | AutoGPT Plugins | ~/.autogpt/plugins/ | Full | | OpenClaw Skills | ~/.openclaw/skills/, workspace skills/ | Full | | Nanobot Agents | nanobot.yaml, agents/*.md | Full | | Supabase | supabase/migrations/, config.toml | Full |

Supabase Security

Firmis auto-detects Supabase projects and scans for:

• Row Level Security: Tables without RLS, missing policies, overly permissive USING (true) clauses
• Storage Buckets: Public buckets, buckets without access policies
• API Keys: service_role key in client code, .env files in git, hardcoded credentials
• Auth Config: Email confirmation disabled, OTP expiry too long, missing SMTP
• Functions: SECURITY DEFINER functions that bypass RLS

# Scan Supabase project
firmis scan --platform supabase

# Example output
  Firmis

  Detecting platforms...
  ✓ Supabase: 8 migrations found

  THREAT DETECTED
     Platform: Supabase
     Component: supabase-project
     Risk: CRITICAL
     Category: access-control

     Evidence:
       - Table 'profiles' has RLS disabled
       - Policy 'allow_all' uses USING (true)

     Location: supabase/migrations/001_profiles.sql:12

Example Output

  Firmis

  Detecting platforms...
  ✓ Claude Skills: 47 skills found
  ✓ MCP Servers: 12 servers configured

  Scanning 59 total components...

  ⚠️  THREAT DETECTED
     Platform: Claude Skills
     Component: data-exporter-v2
     Risk: HIGH
     Category: credential-harvesting

     Evidence:
       - Reads ~/.aws/credentials
       - Sends to: api.suspicious-domain.com

     Location: skills/data-exporter-v2/index.js:47

  SCAN COMPLETE
    57 components passed
    2 threats detected (1 HIGH, 1 MEDIUM)

CLI Reference

firmis scan [path]

Scan for security threats.

Options:
  -p, --platform <name>   Scan specific platform (claude|mcp|codex|cursor|crewai|autogpt|openclaw|nanobot|supabase)
  -a, --all               Scan all detected platforms (default)
  -j, --json              Output as JSON
  --sarif                 Output as SARIF (GitHub Security)
  --html                  Output as HTML report
  -s, --severity <level>  Minimum severity to report (low|medium|high|critical)
  -o, --output <file>     Write report to file
  -v, --verbose           Verbose output
  --concurrency <n>       Number of parallel workers (default: 4)

firmis list

List detected AI platforms.

Options:
  -j, --json              Output as JSON

firmis validate <rules...>

Validate custom rule files.

Options:
  --strict                Enable strict validation

firmis init

Initialize a Firmis config file for the current project.

Options:
  --force                 Overwrite existing config

firmis monitor

Start the runtime monitor. Watches agent tool calls in real time and detects (or blocks, with Pro) anomalous behavior.

Options:
  --mode <mode>           passive | active | audit-only (default: passive)
  --agent <name>          Monitor a specific agent
  -j, --json              Stream events as newline-delimited JSON
  --daemon                Run as a background daemon

Threat Categories

| Category | Severity | Description | |----------|----------|-------------| | credential-harvesting | HIGH-CRITICAL | Access to AWS, SSH, GCP, or other credentials | | data-exfiltration | HIGH | Sending data to external servers | | prompt-injection | MEDIUM-HIGH | Attempting to manipulate AI behavior | | privilege-escalation | HIGH-CRITICAL | sudo, setuid, kernel modules | | suspicious-behavior | LOW-MEDIUM | Obfuscation, anti-debugging, persistence | | access-control | HIGH-CRITICAL | RLS misconfigurations, missing policies | | insecure-config | MEDIUM-HIGH | Auth settings, OTP expiry, SMTP config |

CI/CD Integration

GitHub Actions

name: Security Scan
on: [push, pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Install Firmis
        run: npm install -g firmis-cli

      - name: Run Security Scan
        run: firmis scan --sarif --output results.sarif

      - name: Upload SARIF
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: results.sarif

Pre-commit Hook

#!/bin/bash
# .git/hooks/pre-commit

firmis scan --severity high
if [ $? -ne 0 ]; then
  echo "Security threats detected. Commit blocked."
  exit 1
fi

Custom Rules

Create custom YAML rules for organization-specific threats:

# my-rules/internal-api.yaml
rules:
  - id: internal-001
    name: Internal API Key Exposure
    description: Detects hardcoded internal API keys
    category: credential-harvesting
    severity: critical
    version: "1.0.0"
    enabled: true
    confidenceThreshold: 90

    patterns:
      - type: regex
        pattern: "INTERNAL_[A-Z]+_KEY"
        weight: 100
        description: Internal API key pattern

    remediation: |
      Use environment variables or a secrets manager.

Run with custom rules:

firmis scan --config firmis.config.yaml

# firmis.config.yaml
customRules:
  - ./my-rules/
severity: medium

Programmatic API

import { ScanEngine, RuleEngine } from 'firmis-cli'

const ruleEngine = new RuleEngine()
await ruleEngine.load()

const scanEngine = new ScanEngine(ruleEngine)
const result = await scanEngine.scan('./my-skills', {
  platforms: ['claude'],
  severity: 'medium',
})

console.log(`Found ${result.summary.threatsFound} threats`)

MCP Server

Firmis is available as an MCP server, allowing AI agents to scan code for security threats directly.

Claude Code / Claude Desktop

Add to your MCP settings:

{
  "mcpServers": {
    "firmis": {
      "command": "npx",
      "args": ["-y", "firmis-cli", "--mcp"]
    }
  }
}

Cursor

Add to .cursor/mcp.json:

{
  "mcpServers": {
    "firmis": {
      "command": "npx",
      "args": ["-y", "firmis-cli", "--mcp"]
    }
  }
}

Available MCP Tools

| Tool | Description | |------|-------------| | firmis_scan | Scan a path for AI agent security threats | | firmis_discover | Discover installed AI agent platforms | | firmis_report | Generate an HTML security report |

Contributing

We welcome contributions! Please see CONTRIBUTING.md for guidelines.

# Clone the repository
git clone https://github.com/firmislabs/firmis-scanner.git
cd firmis-scanner

# Install dependencies
npm install

# Run tests
npm test

# Build
npm run build

# Run locally
npm run firmis -- scan

Performance

| Metric | Target | Actual | |--------|--------|--------| | 50 skills scan | < 30s | ~15s | | Memory usage | < 256MB | ~120MB | | False positive rate | < 5% | ~3% |

Security

Found a security vulnerability? Please report it privately to [email protected].

License

This project is licensed under the Elastic License 2.0 (ELv2). You can use, copy, distribute, and modify the software freely, with two limitations:

1. You may not provide it as a managed service
2. You may not circumvent the license key functionality

The scanner engine is also available under Apache-2.0 as a community edition with open-source rules.