AegisQ CodeShield
Beta · v2.1.0 · MCP-native · Zero telemetry

AegisQ CodeShield

Block bad code at the merge.

Real-time security scanning for AI-generated code. 80+ rules across OWASP Top 10, OWASP LLM Top 10, and CISA Secure-by-Design. VS Code extension and a cross-platform MCP server. Source code never leaves the developer's machine. The free tier — the OWASP/CISA Security Scanner — is live on the marketplace today.

~/repo · aegisq codeshield
// scanning agent.py — generated by Claude Code
$ aegisq scan agent.py

SQL injection · clean
XSS · clean
prompt-injection-llm-01 (high)
line 47 · user input flows directly into system prompt
fix: wrap in sanitize_user_input()
excessive-agency-llm-08 (high)
line 89 · agent has unrestricted file write access

$ aegisq fix agent.py --apply prompt-injection-llm-01
Patched · 1 file changed · ready to merge
The AI security challenge

Standard SAST tools were designed before AI was mainstream.

Developers are shipping AI-generated code, LLM integrations, and autonomous agents to production. Standard scanners catch SQL injection and XSS — they don't catch prompt injection, insecure output handling, or excessive agency. CodeShield is built for both.

AI-generated code, untested

Copilot, Claude Code, and Cursor write code at IDE speed. None of them scan it for security issues before it lands in your repo.

LLM-specific attack surface

Prompt injection, training-data poisoning, model DoS, excessive agency — the OWASP LLM Top 10 lists ten classes of risk most SAST tools have never heard of.

Code can't leave the laptop

Regulated teams (finance, health, defense) can't send proprietary or AI-generated code to a vendor's cloud. Scanning has to run locally.

Core features

SAST for the AI era. Zero telemetry. Six purpose-built capabilities.

80+ security rules

SQL injection, XSS, auth flaws, insecure deserialization, full OWASP Top 10, OWASP LLM Top 10, and CISA Secure-by-Design coverage. One ruleset, two threat surfaces.

Privacy-first local analysis

All scanning runs on the developer's machine. Source code, API keys, and proprietary logic are never transmitted externally. Zero telemetry by design.

LLM-agnostic architecture

Works with OpenAI, Anthropic, Google, and self-hosted models. Swap providers without changing the workflow or re-training the rule set.

MCP-native integration

Built on Model Context Protocol — the same protocol Claude Code, Cursor, and Windsurf use. CodeShield is in the editor where the code is, not alongside it.

OWASP LLM Top 10 coverage

Purpose-built detectors for the ten classes of LLM risk: prompt injection, insecure output, training-data poisoning, model DoS, supply-chain, and more.

Actionable remediation

Every finding includes severity classification, file location, the exact line range, and a specific remediation. Optional auto-fix with diff preview before apply.

How it works

Install. Scan. Fix. Ship.

Four steps from the marketplace to a clean merge. No SaaS account required.

01

Install

Add the VS Code extension or run the MCP server locally. CI/CD integration via a single npm or pip package.

02

Scan

Real-time analysis as code is written; on-demand scans for full files; pre-merge scans in CI. 80+ rules, AI-specific risks included.

03

Fix

Prioritized findings with severity, location, and remediation. Optional auto-fix with diff preview before applying.

04

Ship

Compliance reports in OWASP, CISA, and CWE formats. Auditable, deterministic, no external data dependencies.

MCP tools

Six tools your AI assistant can call directly.

CodeShield exposes its scanning, explanation, and reporting capabilities as MCP tools. Claude Code, Cursor, Windsurf, and any MCP-compatible client can invoke them as part of normal coding.

aegisq_scan_file

Scan a file for vulnerabilities. Returns severity-prioritized findings against all 80+ rules.

aegisq_scan_snippet

Scan inline or AI-generated code snippets. Validate before integration into the codebase.

aegisq_explain

AI-powered vulnerability explanation. Risk, impact, and exploitation context in plain English.

aegisq_fix

Auto-fix generation with diff preview. See proposed code changes before they're applied.

aegisq_report

Compliance report in Markdown / JSON / CSV. Export findings in OWASP, CISA, and CWE formats.

aegisq_status

System status: version, license tier, scan count, and cache statistics at a glance.

What's new · v2.1

Hardened against MCP supply-chain attacks.

v2.1.0 hardens CodeShield's own MCP server against the risks set out in the NSA's Model Context Protocol Security Information Sheet — so the tool you trust to find vulnerabilities holds to the same bar.

MCP supply-chain hardening (NSA CSI)

Aligned to the NSA Cybersecurity Information Sheet on MCP, v2.1.0 mitigates cross-server tool poisoning, silent capability drift, and token-lifecycle abuse in the MCP execution model.

Tool integrity & drift detection

Manifest hashing and trusted-publisher checks catch when an MCP tool's definition silently changes, and URN-based identifiers prevent tool name-collision attacks.

Built on v2.0 hardening

Carries forward v2.0's centralized secret redaction in logs and hardened input handling, with a 390+ test suite gating every release.

Why CodeShield

What CodeShield does that the alternatives don't.

vs. traditional SAST

SonarQube, Veracode, and Checkmarx miss AI-specific risks entirely. CodeShield covers OWASP LLM Top 10 alongside classic vulnerabilities — one tool, both surfaces.

vs. GitHub Copilot

Copilot generates code. It doesn't scan for security issues. CodeShield validates what the AI writes, catching risks before they reach the repo.

vs. Snyk / Semgrep

Cloud-only scanners send code off-machine. CodeShield runs entirely locally, supports any LLM provider, and ships LLM-specific rules natively. No vendor lock-in.

80+
Security rules
10/10
OWASP LLM Top 10
6
MCP tools exposed
0
Telemetry events
100%
Local execution
Supported platforms

Wherever you write code, CodeShield runs there.

VS Code Claude Code Cursor Windsurf ChatGPT (HTTP) Any MCP client GitHub Actions GitLab CI
Ideal for

Built for four buyers. One install for all.

Dev teams shipping AI-powered apps

Scan AI-generated code automatically in the IDE. No off-machine transmission, no slowdown.

Security teams with AI coding policies

Get assurance that AI-generated code meets internal standards. Full audit trail per scan.

Compliance-first organizations

OWASP Top 10, OWASP LLM Top 10, CISA Secure-by-Design — output in the formats auditors ask for.

Regulated industries

Finance, healthcare, and defense need auditable, deterministic, local-only scanning. CodeShield is purpose-built for that.

Pricing

Bottom-up developer adoption. Start free, upgrade when you need more.

Free

The open-source OWASP/CISA Security Scanner. Live on the VS Code marketplace today.

$0

Forever free

  • Regex-based scanning
  • 80+ security rules
  • VS Code extension
  • Local-only processing
Install from marketplace

AegisQ.owasp-cisa-security-scanner

Team

For dev teams shipping with AI assistants.

$49 / month

$490 / year (save $98)

  • Everything in Pro
  • 25 HTTP sessions
  • Team management
  • Priority support
  • Enterprise SSO
Get Team

Enterprise pricing available. Contact sales for custom plans, air-gapped install, and dedicated SLAs.

Join the CodeShield beta.

Real-time AI-aware code security in your editor today. No SaaS account, no telemetry, no code leaving your machine.