Security checks your coding agent can call - without making the agent its own security reviewer.
I released two MIT-licensed developer-security tools for AI-assisted development.
AI AppSec audits AI application and agent source code.
MCP Tenant Isolation checks whether tenant boundaries survive across queries, caches, sessions, files, credentials and MCP tools.
Both can run locally and expose focused security checks through MCP.
Secure the code. Protect the tenant boundary. Verify the model interaction.
LLMVerify is the existing runtime sibling in the same HAIEC developer-security family, handling verification around model inputs and outputs.
HAIEC DEVELOPER SECURITY
SOURCE
AI AppSec
scan_ai_security
BOUNDARY
MCP Tenant Isolation
scan_tenant_isolation
RUNTIME
llmverify
verify · isInputSafe · redactPII
Independent tools. Different security questions.
The coding agent can write the change. That does not make it the security authority.
AI-assisted development changes who can create code and how quickly that code can change. A coding agent can add a model call, introduce a tool, change authorization, create a retrieval path, add a dependency, or modify how customer data is queried.
That makes security checks more useful inside the same workflow. But I did not want the answer to be another prompt asking a model whether its own change "looks secure."
The approach behind these tools is simpler: use the coding agent to invoke the right check, return structured evidence, review the result, fix the code, and run the check again.
The agent can reason about the finding. The finding does not have to come from the agent's opinion.
Two releases. Two different security boundaries.
RELEASED · v0.1.0 · MIT
AI AppSec
Evidence-backed AppSec for AI applications and agents.
SOURCE SECURITY
Is this AI application code introducing a security risk?
AI AppSec analyzes AI/LLM application source code before commit, PR, merge or deployment and returns explicit coverage, structured findings and tamper-evident scan evidence.
PROOF
- 122 Public Core detectors
- 79 security checks
- COMPLETE / PARTIAL / ERROR
- Scan Receipts
- Evidence Envelopes
- Proof-of-fix
- MCP v2
- Local scanning
IDENTITY
npm install -g ai-appsecRELEASED · v2.0.0 · MIT
MCP Tenant Isolation
Catch cross-tenant leaks before production.
BOUNDARY SECURITY
Can Tenant A ever become Tenant B?
Purpose-built static analysis for tenant boundaries across multi-tenant SaaS applications and MCP server code.
PROOF
- 57 deterministic rules
- 42 multi-tenant rules
- 15 MCP-specific rules
- COMPLETE / PARTIAL / ERROR
- Scan Receipts
- Evidence Envelopes
- Proof-of-fix
- MCP v2
- read-only MCP by default
IDENTITY
npx mcp-tenant-isolation scan ./srcUse the check that matches the risk.
The tools are intentionally independent.
- -An AI source-code security question should go to AI AppSec.
- -A cross-tenant boundary question should go to MCP Tenant Isolation.
- -A model input/output verification problem belongs to LLMVerify.
Running every security engine for every request would make the workflow harder to reason about, slower to operate and less clear about what was actually evaluated.
AI AppSec: evidence matters as much as the finding.
A list of warnings is useful. It is more useful when you can also answer:
- -What was actually in scope?
- -Which supported files were analyzed?
- -Which files failed to parse?
- -Which checks were evaluated?
- -Is the scan complete or partial?
- -Can this result be reproduced?
- -Did a later rescan confirm the issue was fixed?
AI AppSec v0.1.0 makes those questions part of the scan result.
Coverage semantics
COMPLETE
All supported files in the intended scope were analyzed.
PARTIAL
Some intended evidence could not be analyzed. Absence of findings is not treated as proof.
ERROR
The scan itself could not complete.
Missing evidence is not a pass.
MCP Tenant Isolation: tenant boundaries extend far beyond the database.
A multi-tenant application can filter one SQL query correctly and still leak data somewhere else.
Tenant context can be lost or mixed across:
Tenant Isolation is built around that boundary itself.
Does tenant context still exist at every relevant boundary?
One more layer: verify the model interaction.
EXISTING OPEN-SOURCE SIBLING
llmverify
Verify model interactions before they reach users.
LLMVerify is the runtime/model-interaction layer in this family. It provides local-first checks and utilities around prompt-injection risk, PII redaction, hallucination risk signals, JSON quality and runtime health.
SOURCE
AI AppSec
BOUNDARY
MCP Tenant Isolation
RUNTIME
LLMVerify
Developer, CI, or coding agent.
Developer
Run the tool directly.
npm install -g ai-appsecnpx mcp-tenant-isolation scan ./srcnpm install llmverifyCI
Use independently executable checks in build and review workflows.
Tenant Isolation: SARIF / GitHub Code Scanning, GitHub Action (uses: subodhkc/mcp-tenant-isolation@v2)
AI AppSec: CLI-based scanning with evidence receipts for build and review workflows.
Coding Agent
Invoke focused security checks through MCP.
AI AppSec: scan_ai_security
Tenant Isolation: scan_tenant_isolation
LLMVerify is a runtime library and CLI, not an MCP server.
What these tools do not replace.
Specialized security checks are not a replacement for a broader application security program. These tools are intended to complement controls such as:
AI AppSec uses a pinned Semgrep 1.173.0 execution engine with a bundled Public Core rulepack, then adds HAIEC coverage, evidence, completeness and proof-of-fix semantics around the scan. Semgrep is not invented by HAIEC. It is an external execution engine installed separately.
Why I built them this way.
I spend a lot of time on the question between an AI capability and a production decision:
- -What actually ran?
- -What was checked?
- -What was not checked?
- -What evidence exists?
- -What changed after the fix?
That is also how I approach AI architecture and assurance work. These packages are a practical expression of that philosophy: narrower security questions, explicit scope, inspectable findings and evidence that can be reviewed again later.
Inspect the code. Run the check.
Three independent MIT-licensed developer tools. Powered by HAIEC.