mycop

# mycop

> mycop is an open-source AI code security scanner (SAST) built in Rust. It detects and auto-fixes vulnerabilities in AI-generated Python, JavaScript, TypeScript, Go, and Java code using 200 built-in security rules covering OWASP Top 10 and CWE Top 25 categories.

mycop uses pattern matching and AST analysis via tree-sitter to find security issues like SQL injection, XSS, command injection, hardcoded secrets, insecure cryptography, and more. It supports AI-powered auto-fix with Claude, GPT-4, Ollama, and other providers. Output formats include colored terminal, JSON, and SARIF for CI/IDE integration. It integrates with GitHub Actions, pre-commit hooks, and VS Code. No AI API key is required for scanning — AI is optional and used only for auto-fix and explanation features.

## Documentation
- [GitHub Repository](https://github.com/AbdumajidRashidov/mycop): Source code, README, and full documentation
- [Crates.io Package](https://crates.io/crates/mycop): Rust package registry listing with installation instructions
- [Changelog](https://github.com/AbdumajidRashidov/mycop/blob/main/CHANGELOG.md): Version history and release notes
- [GitHub Action](https://github.com/AbdumajidRashidov/mycop/blob/main/action/action.yml): CI/CD integration for security scanning in pull requests

## Installation
- [Install Script](https://raw.githubusercontent.com/AbdumajidRashidov/mycop/main/install.sh): One-line install for macOS and Linux
- [Homebrew Formula](https://github.com/AbdumajidRashidov/homebrew-tap/blob/main/Formula/mycop.rb): Homebrew tap installation
- [Docker Image](https://ghcr.io/abdumajidrashidov/mycop): Container-based usage

## MCP Server (Agentic Tool Integration)
- mycop includes a built-in MCP (Model Context Protocol) server, started via `mycop mcp`
- Enables Claude Code, Cursor, Windsurf, Codex CLI, Gemini CLI, and other agentic tools to call mycop's scanning and review capabilities directly
- 5 tools: scan, list_rules, explain_finding, review, check_deps (fix is CLI-only — agents apply fixes themselves using scan fix_hints)
- 2 resources: mycop://rules/catalog (JSON), mycop://config/schema (YAML)
- Communicates over STDIO using JSON-RPC 2.0

## Optional
- [Issues](https://github.com/AbdumajidRashidov/mycop/issues): Bug reports and feature requests
- [License](https://github.com/AbdumajidRashidov/mycop/blob/main/LICENSE): MIT License