SentinelMCP
SentinelMCP empowers Python and JavaScript developers to scan repositories for security risks. Run scan_secrets to uncover hardcoded API keys and tokens, check_dependencies to audit requirements.txt or package.json for vulnerabilities, analyze_code_security for insecure patterns, and validate_input for unsafe handling. Aggregate results into a scored security_summary for PR reviews or CI/CD pipelines.
Overview
SentinelMCP provides targeted security scanning tools for source code, dependencies, and projects. Developers can use it to detect hardcoded secrets, unsafe input handling, insecure patterns, and vulnerable dependencies directly in their repositories. This server delivers structured JSON outputs for easy integration into CI/CD pipelines or manual reviews.
Key Capabilities
- validate_input analyzes source code or files for unsafe user input handling, returning findings with patterns, recommendations, and line numbers.
- scan_secrets scans project directories for hardcoded API keys, passwords, or tokens, listing matches by file, line, and type.
- analyze_code_security identifies common insecure patterns in code, providing issue types, severity levels, explanations, fixes, and lines.
- check_dependencies audits requirements.txt or package.json files for known vulnerabilities using pip-audit or npm audit.
- security_summary aggregates results from the other tools into a report with a 0-100 security score, issue breakdown, and total count.
Use Cases
Run scan_secrets on a new repository clone to find exposed API keys before committing changes. Use check_dependencies on a package.json file to list vulnerable npm packages prior to deployment. Combine scans with security_summary to generate a scored report for pull request reviews. Apply analyze_code_security and validate_input to a suspicious function to pinpoint SQL injection risks.
Who This Is For
Software developers and security engineers working with Python or JavaScript projects. Suitable for intermediate users familiar with command-line tools and basic JSON parsing. Ideal for teams maintaining open-source repos or internal codebases needing quick security checks.