CipherNest

Why CipherNest?

Most security tools stop at source code.

CipherNest secures the entire AI application stack.

from a single security engine.

Comparison

Quick start

npx ciphernest scan .
ciphernest benchmark .

Add CipherNest to any AI agent through MCP:

{
  "mcpServers": {
    "ciphernest": {
      "command": "npx",
      "args": ["-y", "@ciphernest/mcp-server"]
    }
  }
}

What CipherNest covers

Run anywhere

CipherNest is a monorepo. All scanner logic lives once in @ciphernest/core. Every client is a thin wrapper.

CLI

npx ciphernest scan .

  ╔═══════════════════════════════╗
  ║   CipherNest Security Scanner  ║
  ╚═══════════════════════════════╝

── CODE ──────────────────────────────
[CRITICAL] CODE001  Dangerous eval()
  src/api.ts:42
  Fix: Replace eval() with JSON.parse() or safer alternatives

── SECRET ──────────────────────────────
[CRITICAL] SEC001  OpenAI API Key
  config.ts:7  sk-proj-ab***REDACTED***

── LLM ──────────────────────────────
[HIGH    ] LLM001  Direct Prompt Injection Risk
  src/chat.ts:18

12 finding(s)  6 critical  6 high  0 medium

Security Grade: C  (score: 65/100)
✅ PASS — no findings at or above high severity

Options:

ciphernest scan .                          # table output (default)
ciphernest scan . --format json            # JSON output
ciphernest scan . --format sarif           # SARIF for GitHub Code Scanning
ciphernest scan . --severity high          # only high and above
ciphernest scan . --fail-on critical       # exit 1 only on critical
ciphernest scan . --no-llm --no-agent      # skip specific scanners
ciphernest scan . --no-docker --no-iac     # skip infrastructure scanners

GitHub Action

- name: CipherNest Security Scan
  uses: ciphernest/scan-action@v1

- name: Upload SARIF to Code Scanning
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: ciphernest-results.sarif

On every pull request, CipherNest posts:

• Inline annotations in the diff (red for critical/high, yellow for medium)
• A PR comment with the security grade and scanner breakdown
• A SARIF file for GitHub Code Scanning integration

## 🟠 CipherNest Security Scan

Security Grade: B  (82/100)

| Severity | Count |
|----------|-------|
| 🔴 Critical | 0 |
| 🟠 High | 2 |
| 🟡 Medium | 5 |

### Top Findings

| Rule     | Severity | Name                      | Location        |
|----------|----------|---------------------------|-----------------|
| `LLM001` | 🟠 high  | Direct Prompt Injection   | `chat.ts:18`    |
| `CICD002`| 🟠 high  | Unpinned GitHub Action    | `ci.yml:14`     |

Action inputs:

- uses: ciphernest/scan-action@v1
  with:
    path: "." # directory to scan (default: .)
    severity: "low" # minimum severity to report (default: low)
    fail-on: "high" # exit 1 if any finding at this level (default: high)
    post-pr-comment: "true"
    sarif-output: "ciphernest-results.sarif"
    github-token: ${{ secrets.GITHUB_TOKEN }}

Action outputs: findings-count, critical-count, high-count, security-grade, sarif-file

MCP Server

Add CipherNest to any AI agent — Claude Desktop, Cursor, Windsurf, LangGraph, Mastra, OpenAI Agents:

{
  "mcpServers": {
    "ciphernest": {
      "command": "npx",
      "args": ["-y", "@ciphernest/mcp-server"]
    }
  }
}

Available tools:

VS Code Extension

Install from the marketplace or:

code --install-extension ciphernest-0.8.8.vsix

Findings appear inline as diagnostics. Open the CipherNest sidebar for the tree view, score, and attack graph.

Architecture

flowchart LR

    A[VS Code / CLI / GitHub / MCP] --> B[CipherNest Core Engine]

    B --> C[Code Security]
    B --> D[LLM Security]
    B --> E[Secrets Detection]
    B --> F[Dependency Security]
    B --> G[MCP Security]
    B --> H[AI Agent Security]
    B --> I[CI/CD Security]
    B --> J[Container & IaC Security]

    C --> K[Analysis & Correlation]
    D --> K
    E --> K
    F --> K
    G --> K
    H --> K
    I --> K
    J --> K

    K --> L[Risk Scoring]
    K --> M[Policy Engine]
    K --> N[Attack Graphs]

    L --> O[Findings Store]
    M --> O
    N --> O

    O --> P[CLI Reports]
    O --> Q[SARIF / JSON]
    O --> R[PR Comments]
    O --> S[SBOM Reports]

    T[LLMs, NVD, OSV, GitHub, Registries] <--> B

    U[AI Agents / Cursor / Claude]
        <--> V[CipherNest MCP Gateway]
        <--> W[MCP Servers]

Every product surface uses the same scanner, rules, scoring, policy, and attack-graph engine.

packages/
├── core/             @ciphernest/core — single source of truth for all scan logic
│   └── src/
│       ├── engine.ts        SecurityEngine orchestrator (9 scanners)
│       ├── types.ts         Finding, SecurityScore, Severity, ScanInput
│       ├── rules/           codeRules, llmRules, secretRules, agentRules
│       ├── scanners/        All scanners (vscode-agnostic)
│       ├── scoring/         scoreEngine — A–F grade
│       ├── policy/          policyEngine — .ciphernest.json
│       ├── attackGraph/     graphBuilder — Mermaid diagrams
│       └── npmShield/       supply chain scanner
│
├── cli/              ciphernest — npm binary + fixture benchmark runner
├── github-action/    ciphernest/scan-action — SARIF + PR comments
├── mcp-server/       @ciphernest/mcp-server — 10 MCP tools for AI agents
└── mcp-gateway/      @ciphernest/mcp-gateway — runtime proxy, block rules, audit log

src/                  VS Code extension — thin adapters over @ciphernest/core

Policy as code

Configure with .ciphernest.json at the project root:

{
  "version": 1,
  "severityThreshold": "low",
  "enabledScanners": [
    "code",
    "llm",
    "secret",
    "dependency",
    "mcp",
    "agent",
    "docker",
    "iac",
    "cicd",
  ],
  "disabledRules": ["CODE014"],
  "severityOverrides": { "SEC010": "high" },
  "excludePatterns": ["**/node_modules/**", "**/*.test.ts"],
  "ciFailThreshold": "high",
  "ciMaxFindings": 0,
  "complianceFrameworks": ["gdpr", "hipaa", "pci", "dpdp"],
  "approvedLLMProviders": ["openai", "anthropic"],
  "autoScanOnOpen": true,
}

Generate a scaffold: CipherNest: Create .ciphernest.json Policy

Scoring

Per-finding deductions: Critical = 25 pts · High = 10 pts · Medium = 4 pts · Low = 1 pt

Per-scanner caps (max total deduction per bucket): Code/Secrets = 30 · LLM/Docker/IaC = 25 · Dependency/Agent/CI-CD = 20 · MCP = 15

The overall score is the average across active scanners only — disabled scanners are excluded from the average, so running fewer scanners does not inflate your grade.

Benchmark results

Run the AI application security benchmark against your project:

ciphernest benchmark .

Run the detection benchmark against known-bad fixture code:

ciphernest benchmark --fixtures owasp-llm10      # OWASP LLM Top 10 (10 cases)
ciphernest benchmark --fixtures owasp-top10       # OWASP Web Top 10 (7 cases)
ciphernest benchmark --fixtures infrastructure    # Docker / IaC / CI-CD (10 cases)

Each fixture run writes the vulnerable code to a temp file, runs the actual scanner, and checks whether the expected rule ID fires — no hardcoded scores.

Example project benchmark output:

Prompt Injection Score      91  ████████████████████░  A
Agent Security Score        88  ████████████████████░  B+
MCP Security Score          93  █████████████████████  A
Supply Chain Score          84  ████████████████████░  B
Infrastructure Score        81  ███████████████████░░  B-

Overall Security Score      87  Grade: B+

Rule reference

OpenAI · Anthropic · AWS · Google · GitHub · Stripe · Slack · Twilio · SendGrid · Mailgun · Cloudflare · HuggingFace · Pinecone · Weaviate · MongoDB Atlas · Generic high-entropy secret

Docker: FROM :latest · Running as root · Secret in ENV/ARG · --privileged flag · Missing HEALTHCHECK

IaC: S3 public ACL · Security group 0.0.0.0/0 · RDS publicly accessible · No encryption at rest · IAM * wildcard · K8s privileged pod

Platform roadmap and extensions

GitHub App

Not an Action — an App. Inline PR comments per finding, like CodeQL and SonarQube:

LLM001 — Prompt Injection Risk

User input passed to LLM without sanitization on line 42.
Attacker can override system instructions and gain tool access.

Suggested fix:
  sanitizeInput(userMessage) before passing to chain.invoke()

Runtime MCP Gateway

@ciphernest/mcp-gateway is a security-aware proxy that sits between an AI agent and any MCP server. It intercepts every tool call at runtime, applies configurable block rules, and logs all activity — without changing a line of agent code.

Agent
  ↓
CipherNest Gateway  ← intercepts every tool call
  ↓  allow / block / flag
MCP Server(s)

Add it to your Claude Desktop (or any MCP host) config:

{
  "mcpServers": {
    "ciphernest-gateway": {
      "command": "npx",
      "args": ["-y", "@ciphernest/mcp-gateway"],
      "env": {
        "CIPHERNEST_GATEWAY_SERVERS": "{\"filesystem\":{\"command\":\"npx\",\"args\":[\"-y\",\"@modelcontextprotocol/server-filesystem\",\"/workspace\"]}}"
      }
    }
  }
}

Default block rules (all configurable via CIPHERNEST_GATEWAY_POLICY env var):

Gateway built-in tools exposed to the agent:

Audit log is written to ~/.ciphernest/gateway-audit.jsonl.

Security Reasoning Engine

Move from rules → findings to rules → findings → explanation:

Current:  LLM001 detected at chat.ts:42

Future:   Prompt injection at chat.ts:42.
          Attacker controlling user_input can override the system prompt,
          gain access to the file_write tool registered at agents.ts:17,
          and exfiltrate /etc/passwd via the HTTP callback in tools.ts:91.
          Business impact: complete agent compromise, data breach.

Marketplace rules (packages/rules)

Rules extracted into a standalone package so the community can contribute and enterprises can buy packs:

npm install @ciphernest/rules-enterprise
npm install @ciphernest/rules-hipaa
npm install @ciphernest/rules-pci

Security

• Threat Model → docs/threat-model.md
• Security Policy → SECURITY.md
• Responsible Disclosure → SECURITY.md

Triage and suppression

Suppress a false positive with a tracked reason:

CipherNest: Suppress Finding

All suppressions are stored in .ciphernest-suppressions.json and visible in the triage report. The audit log captures every suppression with timestamp and author.

License

MIT © Vairamuthu