# Reported issues for agent-security-scanner-mcp

Pod holds 6 of 6 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to [agent-security-scanner-mcp](/mcp/agent-security-scanner-mcp).

## Most discussed

### [Security] Your minimax API key was committed to this repo

Hey! Just a heads-up -- I ran a scan and it looks like an API key got committed to this repo, and it's still active.

| Detail | Value |
|--------|-------|
| Provider | minimax |
| File | `mcp-server-full/rules/python/flask/security/flask-api-method-string-format.yaml` |
| Source | https://github.com/sinewaveai/agent-security-scanner-mcp/blob/71882900e7162e4c4c3e9e53b82a77c9de64bc23/mcp-server-full/rules/python/flask/security/flask-api-method-string-format.yaml |

### What's the risk?

The key i

[Read the thread](https://github.com/sinewaveai/agent-security-scanner-mcp/issues/93) · 2026-05-27 · closed · external user · 1 comment

### [Bug]: Full-project SARIF conversion appears incompatible with current scan-project output

## Summary
The full-project SARIF generation path in the composite action appears to assume a `scan-project` schema that does not match current tool output.

Current action logic expects nested `files[].issues[]`, while `scan-project` currently returns a flat `issues` array (plus `scanned_files`, `by_file`, etc.). This can lead to empty/incomplete SARIF in full scan mode.

## Affected Files
- `.github/actions/security-scan/action.yml`
- `src/tools/scan-project.js` (output shape reference)

## Re

[Read the thread](https://github.com/sinewaveai/agent-security-scanner-mcp/issues/67) · 2026-04-16 · closed · outside contributor · 0 comments

### [Bug]: Composite action can fail-open when scan-results JSON parse fails

## Summary
The composite GitHub Action writes scanner stdout+stderr into `scan-results.json` (`> ... 2>&1`) and then treats JSON parse failures as zero findings.

If scanner logs or warnings are present, the JSON parse can fail and the action proceeds with:
- `ISSUES_COUNT=0`
- `CRITICAL_COUNT=0`
- `WARNING_COUNT=0`

This is fail-open behavior for a security gate.

## Affected File
- `.github/actions/security-scan/action.yml`

## Reproduction
1. Run the composite action where scanner emits stder

[Read the thread](https://github.com/sinewaveai/agent-security-scanner-mcp/issues/69) · 2026-04-16 · closed · outside contributor · 0 comments

### [Bug]: Confidence threshold filtering inconsistent due to case mismatch (semantic findings)

## Summary
Confidence normalization appears inconsistent across engines.

Semantic integration emits lowercase confidence (e.g., `medium`), while config threshold logic expects uppercase keys (`LOW`, `MEDIUM`, `HIGH`). This can cause confidence-threshold filtering to mis-handle semantic findings.

## Affected Files
- `src/semantic-integration.js`
- `src/config.js`

## Reproduction
1. Produce a semantic finding with `confidence: "medium"`.
2. Set `.scannerrc` confidence threshold to `MEDIUM`.
3. 

[Read the thread](https://github.com/sinewaveai/agent-security-scanner-mcp/issues/70) · 2026-04-16 · closed · outside contributor · 0 comments

### [Bug]: scan-project blanket dotfile skip misses security-relevant paths

## Summary
`scan-project` currently skips all entries starting with `.` during directory walk.

This creates blind spots for security-relevant files/directories (for example `.github/workflows`) that should be analyzed when scannable.

## Affected File
- `src/tools/scan-project.js`

## Reproduction
1. Add vulnerable shell/script content in `.github/workflows/*.yml` or another dotpath file.
2. Run `scan-project`.
3. Observe file is not scanned due to `entry.startsWith('.')` skip.

## Expected
- D

[Read the thread](https://github.com/sinewaveai/agent-security-scanner-mcp/issues/68) · 2026-04-16 · closed · outside contributor · 0 comments

### [Bug]: Error on initialization

### Description

```
daniel@selfagency-studio e2e-anywhere % npx agent-security-scanner-mcp init 
file:///Users/daniel/.npm/_npx/3b3ac7183b70dc35/node_modules/agent-security-scanner-mcp/index.js:584

SyntaxError: Unexpected end of input
    at compileSourceTextModule (node:internal/modules/esm/utils:346:16)
    at ModuleLoader.moduleStrategy (node:internal/modules/esm/translators:146:18)
    at #translate (node:internal/modules/esm/loader:431:12)
    at ModuleLoader.loadAndTranslate (node:inte

[Read the thread](https://github.com/sinewaveai/agent-security-scanner-mcp/issues/23) · 2026-03-04 · closed · external user · 2 comments

## Most recent

The remaining reports are on [the project's issue tracker](https://github.com/sinewaveai/agent-security-scanner-mcp/issues).