An MCP security scanner that integrates with AI coding agents like Claude Code, GitHub Copilot, Cursor, and others.

Mimir Scan

"Like Mimir advises Kratos of dangers ahead, Mimir-Scan reveals hidden security threats in your code"

An MCP (Model Context Protocol) security scanner that integrates with AI coding agents like Claude Code, GitHub Copilot, Cursor, and others.

Wraps industry-standard security scanners (Semgrep, Trivy, Gitleaks) plus a built-in prompt injection detector, and exposes them as tools that any MCP-compatible AI agent can call.

Features

• Multi-Scanner: Combines SAST, SCA, secrets detection, and prompt injection scanning
• Security Grade: A-F grading system for quick project health assessment
• SARIF Export: GitHub Security tab integration
• Git Diff Scanning: Fast PR reviews by scanning only changed files
• Auto-Fix: Automatically apply safe fixes (dependency upgrades)
• Prompt Injection Detection: Scan for 23+ injection patterns in AI configs
• Custom Scanners: Bring your own scanner via .mimir.json config

Quick Start

From Source (Recommended)

Clone the repo and install dependencies once:

git clone https://github.com/amitvishw/mimir-scan.git
cd mimir-scan
bun install

Then point your MCP client at the local install (see MCP Client Configuration below).

Using Docker

Docker bundles all scanners - no local installation needed:

docker build -t mimir-scan .
docker run --rm -i -v /path/to/project:/workspace mimir-scan

MCP Client Configuration

Claude Code

Add to your Claude Code settings (~/.cursor/settings.json or project's .mcp.json):

{
  "mcpServers": {
    "mimir": {
      "command": "bun",
      "args": ["run", "--cwd", "/path/to/mimir-scan", "start"],
      "env": {
        "MIMIR_TARGET_DIR": "/path/to/your/project"
      }
    }
  }
}

Claude Code Plugin (with Skills)

If you use Mimir as a Claude Code plugin, it ships with two built-in skills that automate t