STATIC SECURITY ANALYSIS FOR AI SOFTWARE
Catch risky AI trust-boundary crossings before they ship.
SecChecker inspects AI applications, agents, MCP tools and LLM integrations for security-sensitive code paths. Local. Deterministic. No LLM judge.
$
pip install secchecker
$
secchecker . --type llm
01 / THE PRODUCT
One command. A security signal you can inspect.
Run SecChecker while you build or in CI. Findings stay close to the code and can be exported into the workflows your team already uses.
$ secchecker . --type llm --format sarif --verbose [*] Scanning: . [*] Scan type: llm [*] Format: sarif [*] 3 finding(s) across 2 file(s) [+] Report: secchecker_report.sarif
SELECTED FINDING / REPORT PREVIEW
CRITICAL
Tool output reaches command execution
example/agent.py
tool_result ───────▶ command execution
Review the path before the change ships.
LOCALRun against the repository on your machine.
CI READYUse reports and exit codes in automated checks.
OUTPUTSCLI · JSON · Markdown · XML · SARIF · HTML
02 / SIGNAL, NOT SCROLL
Make findings show their work without burying what matters in endless output.
See the decision-relevant part first: what was detected, why it matters, and where it appears.
example/agent.py
03 / WHAT IT CHECKS
Prompt & context
Flags risky transitions where untrusted content can influence privileged AI context.
MCP & tools
Checks tool descriptions, metadata and tool-result handling around sensitive actions.
Model output
Surfaces cases where AI-controlled output can flow into consequential execution paths.
Agent memory
Looks for unsafe persistence of user-controlled or otherwise untrusted content.
Agent control flow
Highlights selected patterns that can make autonomous behaviour harder to constrain or review.
AI credentials
Identifies selected credential-handling risks around AI provider integrations.
04 / EVALUATION
Evaluation should expose blind spots, not hide them.
SecChecker is tested against expected detections, safe counterparts, harder variations and real open-source code. These checks are kept distinct so one strong result cannot mask a weakness elsewhere.
PUBLIC PRINCIPLE
Repeatable · offline · deterministic
Does it keep catching what it already knows?
Regression checks protect expected behaviour from silently breaking between releases.
Does the safer form stay clean?
Safe examples are used to catch obvious overreach and reduce noisy detections.
What happens when the code shape changes?
Adversarial variations are used to expose where deterministic rules stop generalising.
Does it survive outside a synthetic example?
Real open-source AI code is checked to reveal practical false positives and coverage gaps.
NO FINDINGS ≠ SECURE APPLICATION
A static scan is one source of evidence. Findings can be false positives or false negatives, and a clean result is not proof of security.
05 / WHERE IT FITS
Put the check where developers already make decisions.
SecChecker is designed for the pre-deployment path: fast enough to run while building, structured enough to use in review, and explicit about what still needs runtime controls.
Run locally
Check the repository before opening a pull request.
$ secchecker . --type llm
Gate in CI
Emit machine-readable findings and keep the result next to the code change.
SARIF · JSON · exit codes
Know what it is not
SecChecker does not replace code review, threat modelling, red-team testing or runtime policy controls.
STATIC ANALYSIS ≠ RUNTIME ENFORCEMENT
06 / USE IT
Inspect the code before it becomes authority.
Start with one repository. Keep the signal close to the developer workflow.