https://github.com/user-attachments/assets/8e6e1c3f-358a-4cf1-a50c-6e15fbf43c75

What it does

Before you install a plugin or wire up an MCP server, Assay threat-models what it could do, then reads the code for evidence — every finding backed by a verbatim file:line quote. It's built for MCP security and the wider Claude Code attack surface, where the dangerous behavior is usually legal code with bad intent that SAST and dependency scanners miss.

Reasons, doesn't pattern-match — an LLM builds a threat model before it reads source, so the review is hypothesis-driven, not regex.
Catches AI-native threats — prompt injection, MCP tool poisoning, credential exfiltration, hook abuse, capability-vs-claim mismatch.
No confabulation — a post-validator re-reads every citation and drops anything the model can't back with real code.
Runs on your subscription — default mode drives Claude Code via claude -p; no separate API key, no rate-limit walls.
One binary, three roles — the CLI, the assay serve web UI, and the assay mcp server Claude Code drives.

Verdict: safe / caution / unsafe, written as audit.json + audit.md.

Quickstart

git clone https://github.com/chawdamrunal/assay.git && cd assay
make build && make install          # single binary, React UI embedded

assay inventory                     # what's installed in ~/.claude
assay serve                         # http://localhost:7373 → "New Scan"

Full guide → Installation · Quickstart.

Documentation

The full docs live at chawdamrunal.github.io/assay:

Installation — build from source, curl / Homebrew / WinGet / Docker, auth
Quickstart — scan from the web UI or CLI, the pre-install gate, private GitHub repos
How it works — the 5-stage methodology, both scan modes, threat coverage
How to threat-model an MCP server — the practical MCP security checklist
MCP tool poisoning — what it is and how to detect it
Threat model — the 12 AI dev-stack threat classes
FAQ — vs. Snyk / Cisco, API-key needs, tool poisoning, source privacy

Deeper references in-repo: ARCHITECTURE.md · threat model · CHANGELOG.md.

Status

Pre-1.0, under active development. The MCP-server architecture is the default scan path; the legacy in-process orchestrator remains as an API-key / CI fallback. Report a security issue in Assay itself via SECURITY.md.

Contributing

See CONTRIBUTING.md. TDD-disciplined; every finding must cite a verbatim quote — enforced at runtime and in review.

License

Apache-2.0. See LICENSE.

Assay

README