SecureAI-Scan v0.3.0 is a free, local command-line interface scanner that detects security issues unique to AI and large language model (LLM) applications in TypeScript, JavaScript, and Python projects. It identifies vulnerabilities such as prompt injection, misuse of MCP tools, and RAG data poisoning by tracing dataflows from sources to sinks with evidence tiers (proven, likely, heuristic). The scanner also parses MCP configuration files and generates AI Bills of Materials. It supports integration with GitHub Actions and outputs SARIF reports for automated security review. The tool emphasizes precision by resolving SDK imports and minimizing false positives, running fully offline without transmitting code or data externally.

This tool helps identify AI/LLM-specific security vulnerabilities that traditional scanners may miss, enabling developers to detect and fix issues like prompt injection and insecure MCP configurations before deployment. By providing precise evidence and integration with CI/CD pipelines, it reduces the risk of AI-related security flaws in software projects. There is no indication that the tool itself introduces vulnerabilities or that it is exploited; rather, it is a security aid.

This is a security scanning tool, not a vulnerability. No patch or remediation is applicable. Users seeking to improve AI/LLM security in their codebases can adopt SecureAI-Scan v0.3.0 to detect relevant issues. Since it runs locally and offline, it does not expose data externally. No vendor advisory or patch status applies.