Reported issues for agent-security-scanner-mcp

Pod holds 6 of 6 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to agent-security-scanner-mcp.

Most discussed

[Security] Your minimax API key was committed to this repo

Hey! Just a heads-up -- I ran a scan and it looks like an API key got committed to this repo, and it's still active.

What's the risk?

The key i

Read the thread · 2026-05-27 · closed · external user · 1 comment

[Bug]: Full-project SARIF conversion appears incompatible with current scan-project output

Summary

The full-project SARIF generation path in the composite action appears to assume a scan-project schema that does not match current tool output.

Current action logic expects nested files[].issues[], while scan-project currently returns a flat issues array (plus scanned_files, by_file, etc.). This can lead to empty/incomplete SARIF in full scan mode.

Affected Files

• .github/actions/security-scan/action.yml
• src/tools/scan-project.js (output shape reference)

Re

Read the thread · 2026-04-16 · closed · outside contributor · 0 comments

[Bug]: Composite action can fail-open when scan-results JSON parse fails

Summary

The composite GitHub Action writes scanner stdout+stderr into scan-results.json (> ... 2>&1) and then treats JSON parse failures as zero findings.

If scanner logs or warnings are present, the JSON parse can fail and the action proceeds with:

• ISSUES_COUNT=0
• CRITICAL_COUNT=0
• WARNING_COUNT=0

This is fail-open behavior for a security gate.

Affected File

• .github/actions/security-scan/action.yml

Reproduction

1. Run the composite action where scanner emits stder

Read the thread · 2026-04-16 · closed · outside contributor · 0 comments

[Bug]: Confidence threshold filtering inconsistent due to case mismatch (semantic findings)

Summary

Confidence normalization appears inconsistent across engines.

Semantic integration emits lowercase confidence (e.g., medium), while config threshold logic expects uppercase keys (LOW, MEDIUM, HIGH). This can cause confidence-threshold filtering to mis-handle semantic findings.

Affected Files

• src/semantic-integration.js
• src/config.js

Reproduction

1. Produce a semantic finding with confidence: "medium".
2. Set .scannerrc confidence threshold to MEDIUM.

Read the thread · 2026-04-16 · closed · outside contributor · 0 comments

[Bug]: scan-project blanket dotfile skip misses security-relevant paths

Summary

scan-project currently skips all entries starting with . during directory walk.

This creates blind spots for security-relevant files/directories (for example .github/workflows) that should be analyzed when scannable.

Affected File

• src/tools/scan-project.js

Reproduction

1. Add vulnerable shell/script content in .github/workflows/*.yml or another dotpath file.
2. Run scan-project.
3. Observe file is not scanned due to entry.startsWith('.') skip.

Expected

• D

Read the thread · 2026-04-16 · closed · outside contributor · 0 comments

[Bug]: Error on initialization

Description

daniel@selfagency-studio e2e-anywhere % npx agent-security-scanner-mcp init 
file:///Users/daniel/.npm/_npx/3b3ac7183b70dc35/node_modules/agent-security-scanner-mcp/index.js:584

SyntaxError: Unexpected end of input
    at compileSourceTextModule (node:internal/modules/esm/utils:346:16)
    at ModuleLoader.moduleStrategy (node:internal/modules/esm/translators:146:18)
    at #translate (node:internal/modules/esm/loader:431:12)
    at ModuleLoader.loadAndTranslate (node:inte

[Read the thread](https://github.com/sinewaveai/agent-security-scanner-mcp/issues/23) · 2026-03-04 · closed · external user · 2 comments

## Most recent

The remaining reports are on [the project's issue tracker](https://github.com/sinewaveai/agent-security-scanner-mcp/issues).