Sinewave Agent Security Scanner Review 2026

Name: Sinewave Agent Security Scanner
Brand: Sinewave Agent Security Scanner

Honest pros, cons, and verdict on this security tool

✅ MIT-licensed and fully open source — no vendor gating on higher-value features

Starting Price

Free (MIT license)

Free Tier

What is Sinewave Agent Security Scanner?

An open-source, MIT-licensed security scanner — "npm audit for AI agents and MCP servers" — that audits code, MCP tools, prompts, skills, and AI-suggested dependencies over MCP or CLI.

Sinewave's agent-security-scanner-mcp positions itself as "npm audit for AI agents and MCP servers": a free, MIT-licensed scanner that checks code, MCP tools, prompts, skills, and AI-suggested dependencies before your agent trusts them. It is built MCP-first — one command (`npx agent-security-scanner-mcp init claude-code`) installs it as an MCP server into Claude Code, Cursor, Claude Desktop, Windsurf, Cline, Kilo Code, OpenCode, or Cody, exposing tools the agent can call itself. The full version ships 1,700+ security rules across 12 languages with AST and taint analysis, cross-file data-flow tracking, and around 19 MCP tools: scan_security and fix_security (120 auto-fix templates), scan_project with A-F grading, scan_git_diff for PR reviews, check_package and scan_packages that verify imports against 4.3M+ real packages to catch AI-hallucinated dependencies, scan_agent_prompt (59 prompt-injection rules with multi-encoding bypass hardening), scan_agent_action for pre-execution ALLOW/WARN/BLOCK checks on shell commands, and scan_mcp_server, which grades third-party MCP servers for unicode poisoning, tool-name spoofing, and rug pulls. Later versions add CycloneDX SBOM generation with OSV.dev CVE scanning, SOC2/GDPR technical compliance evaluation, an LLM-powered code-review agent with intent profiling (works via Claude CLI with no API key), and GitHub Actions CI integration. A lightweight sibling package, @prooflayer/security-scanner (81.5KB, 400+ rules, zero Python), covers fast regex-only scanning. The project claims 97.7% benchmark precision.

Pricing Breakdown

Open source

Free (MIT license)

per month

✓Full scanner via npm/npx
✓1,700+ rules, 12 languages, AST + taint analysis
✓All MCP tools, SBOM, compliance, and CI features
✓Lightweight @prooflayer/security-scanner variant (81.5KB, 400+ rules)

Pros & Cons

✅Pros

•MIT-licensed and fully open source — no vendor gating on higher-value features
•MCP-first design lets the coding agent scan its own output without a human in the loop
•Purpose-built for agent-specific failure modes: prompt injection, hallucinated packages, tool spoofing
•Claimed 97.7% benchmark precision, with 120 auto-fix templates to close the loop from detection to remediation
•Lightweight @prooflayer variant is a viable pre-commit or CI check when the full scanner is too heavy

❌Cons

•Precision claim (97.7%) is self-reported on the vendor's own benchmark, not an independent evaluation
•Full scanner requires Python plus the AST toolchain — heavier install than a pure JS pre-commit hook
•Auto-fixes are template-based; complex vulnerabilities may need human review after the rewrite
•Rule coverage is language-broad but you should still verify depth for your specific stack
•MCP server auditing scores are only as good as the point-in-time snapshot — a compliant server can still rug-pull on a later run

Who Should Use Sinewave Agent Security Scanner?

✓Auditing an MCP server before adding it to Claude Code, Cursor, or Windsurf
✓Letting a coding agent scan and auto-fix its own generated code
✓Catching AI-hallucinated package names before installing dependencies
✓Gating CI/CD and PRs with security scans and SBOM diffs
✓Screening external input for prompt injection before an agent acts on it

Who Should Skip Sinewave Agent Security Scanner?

×You're concerned about precision claim (97.7%) is self-reported on the vendor's own benchmark, not an independent evaluation
×You're concerned about full scanner requires python plus the ast toolchain — heavier install than a pure js pre-commit hook
×You need something simple and easy to use

Our Verdict

✅

Sinewave Agent Security Scanner is a solid choice

Sinewave Agent Security Scanner delivers on its promises as a security tool. While it has some limitations, the benefits outweigh the drawbacks for most users in its target market.

Try Sinewave Agent Security Scanner →Compare Alternatives →

Frequently Asked Questions

What is Sinewave Agent Security Scanner?

An open-source, MIT-licensed security scanner — "npm audit for AI agents and MCP servers" — that audits code, MCP tools, prompts, skills, and AI-suggested dependencies over MCP or CLI.

Is Sinewave Agent Security Scanner good?

Yes, Sinewave Agent Security Scanner is good for security work. Users particularly appreciate mit-licensed and fully open source — no vendor gating on higher-value features. However, keep in mind precision claim (97.7%) is self-reported on the vendor's own benchmark, not an independent evaluation.

How much does Sinewave Agent Security Scanner cost?

Sinewave Agent Security Scanner starts at Free (MIT license). Check their pricing page for the most current rates and features included in each plan.

Who should use Sinewave Agent Security Scanner?

Sinewave Agent Security Scanner is best for Auditing an MCP server before adding it to Claude Code, Cursor, or Windsurf and Letting a coding agent scan and auto-fix its own generated code. It's particularly useful for security professionals who need advanced features.

What are the best Sinewave Agent Security Scanner alternatives?

There are several security tools available. Compare features, pricing, and user reviews to find the best option for your needs.

More about Sinewave Agent Security Scanner

Pricing Alternatives Free vs Paid Pros & Cons Worth It?Tutorial

📖 Sinewave Agent Security Scanner Overview 💰 Sinewave Agent Security Scanner Pricing 🆚 Free vs Paid 🤔 Is it Worth It?

Last verified March 2026

What is Sinewave Agent Security Scanner?

An open-source, MIT-licensed security scanner — "npm audit for AI agents and MCP servers" — that audits code, MCP tools, prompts, skills, and AI-suggested dependencies over MCP or CLI.

Pros & Cons

✅Pros

•MIT-licensed and fully open source — no vendor gating on higher-value features
•MCP-first design lets the coding agent scan its own output without a human in the loop
•Purpose-built for agent-specific failure modes: prompt injection, hallucinated packages, tool spoofing
•Claimed 97.7% benchmark precision, with 120 auto-fix templates to close the loop from detection to remediation
•Lightweight @prooflayer variant is a viable pre-commit or CI check when the full scanner is too heavy

❌Cons

•Precision claim (97.7%) is self-reported on the vendor's own benchmark, not an independent evaluation
•Full scanner requires Python plus the AST toolchain — heavier install than a pure JS pre-commit hook
•Auto-fixes are template-based; complex vulnerabilities may need human review after the rewrite
•Rule coverage is language-broad but you should still verify depth for your specific stack
•MCP server auditing scores are only as good as the point-in-time snapshot — a compliant server can still rug-pull on a later run

Who Should Use Sinewave Agent Security Scanner?

✓Auditing an MCP server before adding it to Claude Code, Cursor, or Windsurf
✓Letting a coding agent scan and auto-fix its own generated code
✓Catching AI-hallucinated package names before installing dependencies
✓Gating CI/CD and PRs with security scans and SBOM diffs
✓Screening external input for prompt injection before an agent acts on it

Frequently Asked Questions

What is Sinewave Agent Security Scanner?

An open-source, MIT-licensed security scanner — "npm audit for AI agents and MCP servers" — that audits code, MCP tools, prompts, skills, and AI-suggested dependencies over MCP or CLI.

Is Sinewave Agent Security Scanner good?

How much does Sinewave Agent Security Scanner cost?

Sinewave Agent Security Scanner starts at Free (MIT license). Check their pricing page for the most current rates and features included in each plan.

Who should use Sinewave Agent Security Scanner?

What are the best Sinewave Agent Security Scanner alternatives?

There are several security tools available. Compare features, pricing, and user reviews to find the best option for your needs.