mimir-scan

# Mimir Scan

> *"Like Mimir advises Kratos of dangers ahead, Mimir-Scan reveals hidden security threats in your code"*

An MCP (Model Context Protocol) security scanner that integrates with AI coding agents like Claude Code, GitHub Copilot, Cursor, and others.

Wraps industry-standard security scanners (Semgrep, Trivy, Gitleaks) plus a built-in prompt injection detector, and exposes them as tools that any MCP-compatible AI agent can call.

## Features

- **Multi-Scanner**: Combines SAST, SCA, secrets detection, and prompt injection scanning
- **Security Grade**: A-F grading system for quick project health assessment
- **SARIF Export**: GitHub Security tab integration
- **Git Diff Scanning**: Fast PR reviews by scanning only changed files
- **Auto-Fix**: Automatically apply safe fixes (dependency upgrades)
- **Prompt Injection Detection**: Scan for 23+ injection patterns in AI configs
- **Custom Scanners**: Bring your own scanner via `.mimir.json` config

## Quick Start

### From Source (Recommended)

Clone the repo and install dependencies once:

```bash
git clone https://github.com/amitvishw/mimir-scan.git
cd mimir-scan
bun install
```

Then point your MCP client at the local install (see [MCP Client Configuration](#mcp-client-configuration) below).

### Using Docker

Docker bundles all scanners - no local installation needed:

```bash
docker build -t mimir-scan .
docker run --rm -i -v /path/to/project:/workspace mimir-scan
```

## MCP Client Configuration

### Claude Code

Add to your Claude Code settings (`~/.cursor/settings.json` or project's `.mcp.json`):

```json
{
  "mcpServers": {
    "mimir": {
      "command": "bun",
      "args": ["run", "--cwd", "/path/to/mimir-scan", "start"],
      "env": {
        "MIMIR_TARGET_DIR": "/path/to/your/project"
      }
    }
  }
}
```

#### Claude Code Plugin (with Skills)

If you use Mimir as a [Claude Code plugin](https://docs.anthropic.com/en/docs/claude-code/plugins), it ships with two built-in skills that automate t