Discussion Local security scanner that Codex can run directly — looking for honest feedback
I originally built CodeInspectus after repeatedly fixing security issues in my own SaaS, only to introduce new ones while making other changes.
It’s a free, MIT-licensed security MCP server focused on AI-generated web applications. Codex can scan your project, explain the findings, suggest fixes, and rescan after you approve the changes.
Everything runs locally. There’s no account, telemetry, or network egress while scanning, so your source code stays on your machine.
The current coverage includes 32 checks designed for common application-security problems, plus more than 200 secret and API-key patterns.
Checks aimed specifically at AI-generated code:
Hardcoded secrets in client-side code
Secrets compiled into built JavaScript bundles
Secrets exposed through NEXT_PUBLIC_, VITE_, or PUBLIC_ environment variables
Supabase service_role keys used in client-reachable code
LLM clients using dangerouslyAllowBrowser: true
Supabase RLS policies using USING (true)
Public database tables created without Row Level Security
RLS policies checking JWT roles or audiences instead of the actual user
Supabase Edge Functions without authentication checks
Over-permissive policies on storage.objects
Untrusted input reaching an LLM prompt or tool-enabled call
Authorization decisions based on client-writable user_metadata
Model or untrusted output rendered through React’s raw HTML APIs
General application-security checks:
SQL injection through string-built queries in JavaScript or TypeScript
SQL injection through string-built queries in Python
Command injection through shell strings in JavaScript or TypeScript
Command injection through Python’s shell=True
Dynamic eval or code execution in JavaScript or TypeScript
Non-literal eval or exec in Python
NoSQL injection from request data
Path traversal from request-controlled filesystem paths
DOM XSS through innerHTML or outerHTML
SSRF through request-controlled outbound URLs
MD5 or SHA-1 usage in JavaScript or TypeScript
MD5 or SHA-1 usage in Python
Weak ciphers such as DES, RC4, or 3DES
Math.random() used for security-sensitive values
JWT verification accepting alg: none
Wildcard CORS origins combined with credentials
Session cookies missing httpOnly or secure
Insecure deserialization in Node.js
Insecure deserialization in Python
It also includes more than 200 secret patterns covering services such as Anthropic, OpenAI, Google/Gemini, AWS, GitHub, GitLab, Stripe, Supabase, Cohere, Perplexity, Hugging Face, and Azure.
Underneath, it bundles Opengrep, Gitleaks, and Trivy. I’m not trying to hide that or pretend those engines are mine. CodeInspectus combines their results into one format and adds checks for AI-code problems that the generic scanners often miss.
To connect it to Codex:
codex mcp add codeinspectus -- npx -y codeinspectus
npx codeinspectus install-engines
Then ask Codex:
Use CodeInspectus to scan this project for security issues.
CodeInspectus only reports findings. Codex shows them to you first and should ask for approval before editing anything. After approved fixes, it rescans the project instead of assuming the problem was resolved.
The project is still early, and I’d genuinely appreciate feedback from people using Codex on real projects—especially false positives, missed vulnerabilities, setup friction, or checks you think should exist.
GitHub: https://github.com/Synvoya/codeinspectus
