Shellockolm-AI-CLI -Scanner

Shellockolm is a 100% local security scanner that runs as an MCP server to audit React, Next.js and npm-based projects for CVEs, malware, and supply chain issues. The server exposes a CLI workflow via Python (src/cli.py) to perform comprehensive scans, including vulnerability detection, malware/secret scanning and auto-remediation workflows. Use it inside your AI-assisted tooling or CI pipelines to generate security reports and export JSON outputs for integration. Typical usage involves invoking the full security audit, or targeted scans for npm packages, React/Next.js components, and secrets patterns. The MCP setup enables you to call the scanner as part of automated agent workflows, returning structured results suitable for policy checks and remediation suggestions.

Prerequisites:

• Python 3.10+ installed on your system
• Git to clone the repository
• Optional: virtual environment tool (venv) for isolation

Installation steps:

1. Clone the repository: git clone https://github.com/hlsitechio/Shellockolm-AI-CLI-MCP-Scanner.git cd Shellockolm-AI-CLI-MCP-Scanner
2. (Optional) Create and activate a virtual environment: python -m venv venv source venv/bin/activate # on macOS/Linux venv\Scripts\activate # on Windows
3. Install Python dependencies (if a requirements file exists): pip install -r requirements.txt # if provided by the project
4. Run a test scan locally to confirm the setup: python src/cli.py scan .
5. Start using the MCP integration by configuring the mcp_config (see above) and invoking the scanner via the MCP runner in your environment.

Tips and common issues:

• Ensure Python 3.10+ is used to avoid compatibility issues with dependencies.
• If you see network-related errors during installation, ensure network egress is allowed or use a local mirror.
• The scanner runs fully offline for vulnerability checks that have been pre-curated in the tool. For new CVEs, ensure the data pack is updated or re-run in an environment with internet access when updating databases.
• If you customize the working directory, pass the path to the project you want to scan as an argument to the CLI (e.g., python src/cli.py scan /path/to/project).
• The MCP config exposes environment variables for log verbosity or integration hooks; adjust as needed for your CI/CD or agent environment.