Open Source Appsec Scanner
type: NewsArticle
description: ProofLayer released version 4.3.0 of its open-source application security scanner for AI coding agents, adding critical security and reliability fixes including GitHub Actions now failing closed instead of fail-open to prevent security gate bypass. The 81.5KB package, which installs in four seconds and scans code across 12 languages with 1,700+ security rules, also patched eight Hono CVEs covering XSS, path traversal, and authentication bypass. The update includes compliance evidence collection against SOC2 and GDPR frameworks, SBOM generation with dependency vulnerability analysis, and LLM-powered semantic code review with intent profiling.
date published: 2026-06-03 12:28:16+00:00
date modified: 2026-06-03 12:47:49.772733+00:00
language: en
is accessible for free: true
article body: **Security scanner for AI coding agents and autonomous assistants** Scans code for vulnerabilities, detects hallucinated packages, blocks prompt injection, and provides LLM-powered semantic code review — via MCP (Claude Code, Cursor, Windsurf, Cline) or CLI (OpenClaw, CI/CD). **Ultra-fast, zero-Python security scanner** — 81.5KB package, 4-second install ``` npm install -g @prooflayer/security-scanner ``` - ⚡ **4-second install**(vs 45s traditional scanners) - 📦 **81.5KB package**(vs 50MB+ alternatives) - 🚀 **Instant scans**- pure regex, no Python/LLM - 🛡️ **400+ security rules** across 9 languages - 🎯 **7 MCP tools** for AI agents - ✅ **Zero dependencies** on Python - 💯 **MIT licensed**- free for commercial use **Enterprise-grade scanner** with AST analysis, taint tracking, cross-file analysis, and LLM-powered semantic review ``` npm install -g agent-security-scanner-mcp ``` - 🧬 **AST + Taint Analysis**- deep code understanding - 🔍 **1,700+ security rules** across 12 languages - 📊 **Cross-file tracking**- follow data flows - 🎯 **11 MCP tools**+ CLI commands - 📦 **4.3M+ package verification**(bloom filters) - 🐍 **Python analyzer** for advanced features - 🤖 **LLM-powered code review**- semantic security analysis with intent profiling Continue reading below for full version documentation → New in v4.3.0 (2026-05-05):Critical security and reliability fixes — GitHub Actions nowfail closedinstead of fail-open when scanner output is invalid (preventing security gate bypass), patched8 Hono CVEs(XSS, path traversal, authentication bypass), fixed confidence threshold filtering case sensitivity, and corrected SARIF generation for GitHub Code Scanning. All fixes include comprehensive regression tests.Upgrade recommended for production use.[See Full Changelog]. New in v4.2.0:Compliance evidence collection — evaluate projects against SOC2-Technical (8 controls) and GDPR-Technical (6 controls) frameworks. Collects evidence from code scans, SBOM, vulnerability checks, and hallucin…
publisher: Web Pulse
keywords: ai-agents, ai-tools, ai-safety, ai-products, ai-infrastructure
mentions: ProofLayer
mentions: Claude Code
mentions: Cursor
mentions: Windsurf
mentions: Cline
mentions: OpenClaw
mentions: GitHub Actions
mentions: MIT
citation: CreativeWork