AI PatchLab Scans

Security scans of public repositories run with AI PatchLab, an open-source, local-first security scanner.

Every report on this page was generated locally. No source code was sent to any third party, no AI provider was contacted, and no paid API was called. AI PatchLab orchestrates Semgrep, Gitleaks, Trivy, and pip-audit, then applies deterministic remediation and confidence rules to normalize the findings.

Want this run privately against your own codebase? I do independent security review of AI agents, MCP servers, and LLM apps — work with me →. 54 scans, 11 confirmed fixes, methodology in the open.

OpenAI just launched Daybreak and Patch the Planet. Same remediation loop, opposite trade-off: their path is a cloud frontier model; this one keeps your code on your disk. Why local-first still matters →

How these scans work

• Each scan targets a public repository at a specific commit.
• Findings are curated: noise filtered out, top items highlighted.
• Critical issues are reported to maintainers under responsible disclosure before being published here in full detail.
• Posts focus on patterns and lessons — not exploit walkthroughs.

Scans

• 2026-07-22 — mixelpixx/KiCAD-MCP-Server — 29 findings, 0 real — 20th clean scan: an MCP server (1.6k★, MIT) that drives KiCAD for AI-assisted PCB design — a TypeScript protocol server that spawns a long-lived Python pcbnew backend, STDIO transport only. For an MCP server the question is whether a tool argument reaches a dangerous sink, and every candidate closes: the freerouting autorouter shells out to java -jar but builds an argv List[str] (no shell=True, AI-supplied paths are argv elements — credit the defense, à la potpie); the datasheet helper constructs an LCSC URL and never fetches it (no SSRF, the tradingview-mcp constant-authority pattern); express is imported but never listens → no network surface to protect. The 4 JLCPCB SQL “highs” are the #1 recurring parameterized-identifier FP (f"…FROM [{relation}]" from the source DB’s own schema, values bound ?); the 2 child_process highs are operator-gated (pythonExe from KICAD_PYTHON env, and the real spawn path already uses argv — an execFile nit); the 4 path-traversal are constant segments on a __dirname root. The one genuine residual is DoS-only: 6 stdlib ElementTree import parsers with no defusedxml — but CPython’s etree doesn’t resolve external entities, so it’s billion-laughs entity-expansion (local, self-inflicted on importing a malicious design file), not XXE file-read/SSRF. Gitleaks/Trivy/pip-audit all clean. Not strict-norm · post-only
• 2026-07-21 — ucbepic/docetl — 124 findings, 1 real — and no tool ranked it — an agentic map-reduce / document-ETL engine (3.9k★, UC Berkeley EPIC) with a FastAPI backend and a Next.js DocWrangler UI. The exec/eval the scanner headlines are the documented code-operator model (author writes a transform; the engine runs it — by-design, à la ag2 / datachain), so the real finding is the mundane plumbing bolted beside it: the /fs router (read-file/read-file-page/check-file/write-pipeline-config/save_workspace) takes a raw client-supplied path/namespace with no confinement and no auth → unauthenticated arbitrary file read and write (plus a fetch-and-store SSRF in upload-file?url=, follow_redirects=True, no allowlist). The tell: serve-document one function up does carry an if ".." in path guard — the pattern is understood, just not applied. Reachability is the whole story and it cuts both ways: bare-metal binds localhost and CORS defaults tight (both credited), but the shipped docker-compose.yml binds BACKEND_HOST=0.0.0.0 with zero auth in the server, the pipeline route drives DSLRunner from a request-supplied yaml_config (code-operators = the ceiling above the file-read floor), and the docetl-aws profile mounts ~/.aws:ro → an unauth file read is a cloud-cred read. Meanwhile Semgrep’s 14 traversal hits all landed in the TS frontend, not this Python sink (scanner under-count, the zotero-mcp sweep lesson), and the report’s “critical” was a low-reachability nltk Zip-Slip. Deps: 3 crit across uv.lock + package-lock.json, no Dependabot (Kiln coverage gap) → filed #505. Not strict-norm · post + focused issue
• 2026-07-20 — ModelEngine-Group/nexent — 115 findings, 0 real — 19th clean scan, and one of the widest surfaces in the series: a zero-code AI-agent platform (5.7k★) with its own JWT/CAS/Supabase auth, an MCP tool broker (fastmcp), a SQL monitoring tier, a Ray/Celery data stage, and a full Docker/Kong/Helm deploy stack. On an agent platform the boundary that matters is auth, and nexent’s holds: every authenticating jwt.decode pins algorithms=["HS256"], uses the env-loaded SUPABASE_JWT_SECRET, and fails closed — the one verify_signature: False hit is a peek-for-sid on the logout path (server-side CAS session check behind it, à la IBM ContextForge), and the jwt-hardcode is a MOCK_JWT_SECRET_KEY whose only callers are the test module (inert against the real verifier). The 33 “highs” collapse: 11 run-shell-injection are all workflow_dispatch (maintainer-only privileged trigger = hardening, the openmed trigger-context lesson), the SQL text() is the #1 parameterized-identifier FP (hours resolves to a whitelisted int, tenant_id is bound), and the rest is ws:// service-mesh config + root-user Dockerfiles + a nexent@2025 default-password fallback (operator-overridable). Deps floor-pinned (>=) + defusedxml; nested pyproject.tomls went unaudited (root-anchored pip-audit gap, the Kiln coverage asymmetry). Strict-norm (private SECURITY.md) · post-only
• 2026-07-19 — vitali87/code-graph-rag — 22 findings, 1 real, reachable — a graph-RAG that parses codebases with Tree-sitter and ships an MCP server with code-editing. The RAG engine invites an exec/injection hunt, but it’s a dead end: the six non-literal-import hits are dynamic Tree-sitter grammar loading keyed on a typed SupportedLanguage enum, and the two dynamic-urllib hits are a host-pinned pypi.org/{pkg} README fetch + a local health probe — neither SSRF. The real signal was the MCP transport posture: mcp is pinned to 1.25.0, which carries three published CVEs, and the project stands up the exact transport the worst one targets — serve_http() mounts StreamableHTTPSessionManager.handle_request behind a bare Starlette route with no auth, default bind 0.0.0.0:8080. That makes CVE-2026-52869 (“HTTP transport serves sessions without verifying the authenticated principal”) reachable, not version-match. The reachability splits cleanly: 52869 live, 52870 (experimental task handlers) conditional, CVE-2026-59950 inert (it needs a WebSocket transport the server never speaks) — one bump to mcp>=1.28.1 clears all three. Same “version-match ≠ reachable transport” lesson as tradingview-mcp, but here the vulnerable transport is exposed by default. The other 4 “highs” are FP (SONAR_TOKEN secrets-ref; a constrained type: choice workflow input) → filed #808 → ✅ RESOLVED same-day (PR #809 merged: mcp>=1.28.1 + lock regen + MCP_HTTP_HOST loopback default; maintainer verified every claim including the honest triage that only 52869 is live). Not strict-norm · post + focused issue
• 2026-07-18 — algorithmicsuperintelligence/optillm — 57 findings, 1 real residual — an OpenAI-compatible optimizing inference proxy (4.2k★) whose approaches run code (Z3, executecode), read URLs, and web-search. The core proxy is built carefully — timing-safe secrets.compare_digest auth, localhost-default binding, no wildcard CORS, operator-set base_url (no forward-SSRF) — so the count collapses: 51 are action-pin CI lint, the lone “high” run-shell-injection is release-gated (maintainer-controlled head_branch, not fork), non-literal-import is a hardcoded dict, and the two exec/Jupyter code-exec sites are the advertised executecode/z3 approaches (honest product surface, à la ag2 — not an Agently-style broken sandbox promise). The one genuine residual is scanner-silent: readurls calls requests.get() on every prompt-extracted URL with no SSRF guard (no private-IP / loopback / 169.254.169.254 block), and a caller picks the approach by request field — so a hosted proxy can be steered to read cloud metadata / internal services. Same egress class as a2a-python (undefended) vs IBM (defended); here fully attacker-chosen → filed #323. Not strict-norm · post + focused issue
• 2026-07-17 — IBM/mcp-context-forge — 946 findings, 0 real — 18th clean scan, and the richest attack surface in the series: an AI gateway / registry / reverse proxy (IBM ContextForge, MCP Gateway) that authenticates callers, forwards credentials to upstream MCP/A2A/REST backends, proxies tool calls, and discovers JWKS keys. The finding class that matters on a gateway is SSRF egress — and unlike a2a-python (undefended), it’s thoroughly guarded: a dedicated SecurityValidator._validate_ssrf that’s secure-by-default (protection on, cloud-metadata + link-local always blocked, localhost and RFC 1918 blocked unless you opt in), wired into every egress path with redirect-protection tests. The 11 “unverified JWT decode” highs are all the peek-iss-then-verify pattern (or a token the gateway just created); the auth path verifies before it grants. And the count is a tooling artifact: 521 of 581 “secrets” live inside the project’s own .secrets.baseline — Gitleaks re-flagging detect-secrets’ own audit file. The ~80 Admin-UI XSS/CSRF findings are documented dev-only scope; deps clean (pip-audit 0). Strict-norm (IBM PSIRT private reporting) · post-only
• 2026-07-16 — a2aproject/a2a-python — 20 findings, 0 real — the official Agent2Agent protocol SDK (Google/Linux Foundation). For a protocol SDK the security is the peer boundary — auth + callbacks — and the code is clean: the auth interceptor logs scheme names, not tokens, secrets are confined to tests/, deps on Dependabot. The one surface worth writing down is the push-notification webhook: BasePushNotificationSender POSTs task updates to the client-supplied push_info.url with no SSRF egress validation (is_private/urlparse/validate_url = 0 across the repo). Real webhook-SSRF shape — but authenticated (the task submitter’s own webhook), blind (POST, no response returned), and library-level (egress policy is the deployer’s job); and the design does authenticate webhooks (X-A2A-Notification-Token, anti-spoofing). A deployer-hardening note (allowlist push URLs), not a filing. Strict-norm (private-reporting SDK) · post-only
• 2026-07-15 — mnemosyne-oss/mnemosyne — 195 findings, 0 real — 17th clean scan, and the largest SQL cluster in the series: a zero-dependency SQLite-backed AI memory system where 140 of 195 findings are one parameterized-SQL false positive. On a store that holds user text, 128 SQL “highs” reads as an injection fire — but every value is a bound ? param (with LIKE … ESCAPE '\\', which most forget), and the only f-string tokens are internal table/column names ("working_memory"/"episodic_memory") and constant embedding dims in CREATE VIRTUAL TABLE DDL. Two representative queries settle all 140. The 21 dynamic-urllib are operator-directed imports (honcho/zep) + own-server sync (not SSRF), the “secrets” are docs/sync/tutorial.md examples, and sync uses client-side XChaCha20-Poly1305 so the server never sees memory content. Strict-norm · post-only
• 2026-07-14 — datachain-ai/datachain — 35 findings, 0 real — 16th clean scan: a Python “context layer” for unstructured data (DVC/Iterative team; typed versioned datasets over S3/GCS, UDFs at scale, hosted Studio). For a library that caches datasets and ships UDFs to distributed workers, the question is deserialization — and the sweep clears it: no pickle.load/loads/cloudpickle.loads in source at all; the pickle/cloudpickle (26 sites) is dumps serializing the user’s own UDF for its own workers — the scary primitive only on the write side. The one exec (meta_formats.py:161) is documented schema-inference codegen over your own data (a static spec= skips it). The count is 26 workflow-tag lint + a by-design backend loader; deps clean (Dependabot wired); gitleaks 2 = docs + a fake-service-account fixture. Strict-norm (Studio) · post-only
• 2026-07-13 — potpie-ai/potpie — 96 findings, 0 real — 15th clean scan: a code-context-graph SDLC platform (FastAPI + a subprocess sandbox + repo ingestion, hosted at potpie.ai). The wide surface was the point, and it held: the subprocess-injection hits are the sandbox executor, but _command() returns an argv list (no shell) or shlex.quotes each part, with a Docker-isolated runtime alongside; and CORS lives in a dedicated _hardening.py that’s secure-by-default — origins from an env allowlist (default empty), allow_credentials=bool(origins), methods/headers [] when unset (never wildcard-with-credentials), plus security headers + rate-limits. The 96 count is a legacy/ tree (7 highs + 13 trivy Dockerfile misconfigs) + 20 workflow-tag lint; deps clean (0 CVEs), gitleaks 3 = template/tests. Strict-norm (commercial) · post-only
• 2026-07-10 — sooperset/mcp-atlassian — 71 findings, 0 novel code — the popular (5.5k★) Jira/Confluence MCP server. The credential-server question a scanner skips — does it protect tokens on the wire? — had to be traced by hand, and clears: ssl_verify defaults to True (jira/config.py:104); the verify=False/CERT_NONE path is an explicit opt-in for self-signed Server/DC certs. The two criticals are public dep CVEs — authlib 1.6.8 (JWK-injection auth-bypass) + fastmcp 2.14.5 (authenticated SSRF) — reachable only in the optional multi-user OAuth mode, inert in the default single-user PAT deployment (authlib has 0 direct imports). Fix = bump authlib→1.6.9 (one patch) + fastmcp→3.2.0 (major) + wire Dependabot. gitleaks 8 = all docs/tests. Strict-norm (SECURITY.md requests private reporting; CVEs are public) · post-only
• 2026-07-09 — VectifyAI/OpenKB — 23 findings, 0 real — 14th clean scan: a CLI that compiles documents into a wiki-style LLM knowledge base. Because it’s a CLI — no server, no auth — the sharpest curation move is reachability: trivy’s highs are starlette (SSRF/Host), python-multipart (form-DoS), and pyjwt (token-verify) — all of which describe a web service OpenKB never starts, so they sit inert (transitive). The reachable deps are the boring ones — a deprecated PyPDF2 on the untrusted-PDF path (parser DoS; migrate to pypdf) + aiohttp/lxml-html-clean bumps. Code is clean (the one urllib hit is an operator-directed openkb add <url> download, not SSRF/crawl), and the maintainer pins deps deliberately (“supply-chain caution — e.g. the litellm poisoning incident”). gitleaks clean · post-only
• 2026-07-07 — atilaahmettaner/tradingview-mcp — 28 findings, 0 real — 13th clean scan: a market-data MCP server (~30 tools for Claude/Cursor). The sharp MCP question — can a tool argument steer a server-side fetch? — comes back negative: the Yahoo/CoinGecko hosts are hardcoded constants and a tool input only fills a {symbol} slot after the authority (f"{_YF_BASE}/{symbol}?..."), so it can’t redirect to a new host (contrast zotero-mcp, where it could). Better still, the design holds no credentials — public endpoints only, no TradingView account/key — deleting the whole credential surface; gitleaks clean. The residual is a transport-gated dep refresh (mcp SDK CVE reachable; starlette/python-multipart reachable only in the hosted HTTP mode; no Dependabot). Strict-norm (commercial cryptosieve.com tier) · post-only
• 2026-07-03 — AgentEra/Agently — 25 findings, 1 real — a GenAI framework that runs model-generated Python through a component named PythonSandbox, described as running code “safely.” But the isolation is best-effort restricted-exec: SAFE_BUILTINS + a _-attr guard that only covers wrapped preset objects, so a literal the executed code creates itself (().__class__.__bases__[0].__subclasses__()) walks to subprocess/os and escapes to host RCE. Reached from the model’s tool argument (action_input["python_code"] → sandbox.run). The inverse of the AG2 case: a component that advertises a boundary it doesn’t enforce. The other 14 “highs” are one parameterized-SQL FP cluster (LocalBackend.py); deps + secrets clean · filed #312 · ✅ RESOLVED — released in agently 4.1.4.1 (~5 days): maintainer replaced in-process exec with a Docker-backed default sandbox that fails closed, demoting the legacy runner to an explicit trusted_local opt-in (145-test regression suite). The structural fix the report recommended, not a denylist patch
• 2026-07-02 — UKGovernmentBEIS/inspect_ai — 161 findings, 0 real — 12th clean scan: the UK AI Security Institute’s LLM-eval framework, where the threat model is the sandbox (it runs model-authored bash/python tools). The two findings a scanner headlines are both already defended: the tarfile.extractall sandbox-escape on checkpoint restore carries filter="data" plus an inline CVE-2007-4559 citation (PEP 706), and the pickle is a trusted local model-response cache. The eval() “code-exec” hits are calls to Inspect’s own public eval() API (FP); the log-store SQL is parameterized; the lone critical is a transitive, unreached jupyter-server CVE (0 direct imports, no Jupyter web app). The 62-finding bulk is GitHub-Actions tag-pinning lint. gitleaks clean, Dependabot wired · post-only
• 2026-07-01 — Soju06/codex-lb — 76 findings, 0 real — 11th clean scan, and the most credential-dense target yet: a ChatGPT/Codex-account load balancer + token-pooling proxy + dashboard. The finding that actually matters for a credential proxy — the documented localhost auth-bypass — is one semgrep never raises, and the maintainer already engineered it correctly: resolve_connection_client_ip only trusts X-Forwarded-For when the socket peer is inside a configured trusted-proxy CIDR set, with chain validation, header sanitization, an explicit auth-mode enum, and a firewall IP-resolution test. So X-Forwarded-For: 127.0.0.1 from a stranger is ignored. The 47 “highs” are Alembic migrations + Markdown; the live-code SQL is parameterized; OAuth logging is request-id-only (never the token); the lone SHA-1 is the RFC 6455 WebSocket handshake (protocol-mandated). Deps clean (Renovate) · post-only
• 2026-06-30 — openagents-org/openagents — 680 findings, 0 real first-party — the harbor pattern again, at scale: an “AI Agent Networks” monorepo where the count almost entirely describes the bundled JS/TS frontends, not the Python agent core. All 8 criticals are npm frontend lockfiles (protobufjs/shell-quote/form-data across sdk/studio 154 advisories, workspace/frontend, packages/go/web); ~300 semgrep hits are js-* lint in packages/agent-connector/launcher. The Python core is modest and by-design: shell=True launches local npm, non-literal-import is the local mod-loader, eval is in examples/. The scary-looking cleartext ws:// is mostly mitigated — the default relay is already wss://relay.openagents.org (https→wss upgrade); only a secondary direct-peer path is ws://. Two gitleaks hits are Firebase web keys (public by design). Dependabot active · post-only
• 2026-06-28 — SwanHubX/SwanLab — 32 findings, 0 code-level — 10th clean scan, and an unusual one: the interesting result is the absence of findings. A 4k-star self-hosted AI experiment-tracking platform (W&B-style, with auth/upload/webhooks) where semgrep scanned 361 swanlab/ source files and returned zero — no injection, no shell=True, no SSRF pattern. The two gitleaks hits are test fixtures. The entire residual is a 30-CVE uv.lock with no Dependabot, and reachability splits it cleanly: starlette/ujson/fastapi have zero direct imports (transitive — the multi-user server backend isn’t in this SDK/dashboard repo), while pillow (OOB-write + decompression CVEs) is genuinely reachable through swanlab.Image media logging (though an optional extra). Strict-norm (real SECURITY.md + commercial cloud) · post-only
• 2026-06-26 — ag2ai/ag2 — 73 findings, 0 real/reachable/undefended — AG2 (formerly AutoGen), the canonical “agents that write and run code” framework, which inverts the usual curation question: the dangerous calls (exec, docker run, LocalCommandLineCodeExecutor, Jupyter kernels) are the product. The one place attacker-influenced data meets eval() — ContextExpression — is already escaped and carries an inline GHSA-9fvw-gr53-m7fw reference (the maintainers patched their own eval-injection). All 19 secret hits are FP — docstring Example: keys annotated # pragma: allowlist secret, renderer wire-contract constants, tests, and .mdx docs. Deps are current (Dependabot wired; trivy found one devcontainer-root nit). The one honest residual is ag2 serve: no auth + wildcard CORS (credential-less variant) + a built-in --ngrok flag, gated behind operator choices · post-only
• 2026-06-25 — Kiln-AI/Kiln — 150 findings, 0 real/reachable/undefended — and the sharpest reachability-illusion in the series: trivy returns 4 critical / 46 high, the two criticals are langchain-core RCE on a repo whose production code never imports LangChain (all 11 import sites are test_*.py; the runtime adapter is LiteLLM-based). langsmith is transitive-only, starlette/mcp are runtime server deps but the server binds localhost, and the hardcoded GitHub App secret is a documented PKCE-protected native-client tradeoff. The real signal isn’t a vuln — it’s a lockfile-coverage asymmetry: Dependabot auto-updates the npm frontend (undici/dompurify/vite) but the three Python uv.locks (root, libs/core, libs/server) drift uncovered (no dependabot.yml, uv.lock unparsed). Commercial-backed (Kiln Pro) · post-only
• 2026-06-24 — maziyarpanahi/openmed — 44 findings, 0 real/reachable/undefended — 9th clean scan, and the first healthcare-domain scan: a local-first clinical-NER + HIPAA-PII tool loading 1,000+ HuggingFace models. The review converges on the one vector that matters — arbitrary code execution via trust_remote_code against a malicious model — and the maintainer got there first: it defaults off, an allowlist + a constructor that hard-refuses out-of-allowlist remote code, and a regression test headed with its own CVE-2026-47117 enumerating the substring-bypass (attacker/foo-privacy-filter-bar). The 24-CVE lockfile tail is real but transitive and reachability-gated (starlette = opt-in service extra, gitpython kwargs-RCE never called, urllib3 DoS from trusted HF) — and Dependabot is already wired. Workflow shell-injection is workflow_dispatch-gated (privileged) · post-only
• 2026-06-23 — stickerdaniel/linkedin-mcp-server — 6 findings, 0 real after curation — 8th clean scan, and the sharpest “static rules can’t see intent” case yet: an MCP server that decrypts your LinkedIn cookie out of the local Chromium keychain, where the scanner’s four code-level hits are all the hardening itself — SHA1-inside-PBKDF2 (mandatory for Chromium-cookie interop), 0o700 on the secrets tempdir (the rule’s suggested 0o644 “fix” would make them world-readable), a hardcoded GitHub-API urllib call, and a CredentialsNotFoundError log misread as a leak. Two transitive dep CVEs (starlette, pydantic-settings) are version-match but unreachable · post-only
• 2026-06-21 — taylorwilsdon/google_workspace_mcp — 16 findings, all FP/by-design — 7th clean scan in the series, and the most instructive: an OAuth MCP server (Gmail/Calendar/Docs) where the scanner fired exclusively on the credential layer and every hit was the developer doing it right — unverified-decode of an already-trusted token for email, a log-suppression comment misread as a token leak, 0o600 token files, fingerprinted logging, a loopback self-probe · post-only
• 2026-06-19 — xerrors/Yuxi — 70 findings, a well-built multi-tenant harness: a sharp reachability discipline traced three tenant/agent sinks (agent-SQL, tenant-JWT, markdown v-html) and every guard held — strict validate_table_name allowlist, textbook jwt.decode, DOMPurify. Residual: wildcard CORS + credentials + a reachable pyjwt/langchain dep tail · ✅ Both items fixed ~2 days later (CORS env-allowlist + credentials downgrade, pyjwt 2.13.0)
• 2026-06-15 — harbor-framework/harbor — 570 findings, and the count means almost the opposite of what it looks like: 464/570 (81%) and all 10 criticals are in 84 vendored benchmark adapters (adapters/*), not harbor’s code. Harbor-core (34 findings, 0 critical) does the dangerous things right (tar filter="data", Supabase publishable keys, by-design sandbox subprocess). The lesson: the first curation step on a monorepo is an ownership split. Filed one structural question on the sandbox-isolation threat model, not a 570-finding enumeration
• 2026-06-12 — mistralai/mistral-vibe — 21 findings, a clean coding-agent scan: the git wiring is safe-by-construction (GitPython argv API, no shell; hashlib.sha1(..., usedforsecurity=False) explicitly non-crypto). Real signal is a dependency tail with a sharp reachability split — gitpython imported/reachable (bump it), pyjwt declared-but-never-imported (version-match, not applicable)
• 2026-06-11 — dataelement/Clawith — 54 findings, and the scan that caught a silent-failure bug in AI PatchLab’s own scanner: Semgrep crashed mid-write (Windows cp1252 vs the repo’s Chinese source), left a 0-byte report, and 43 findings vanished — the first pass looked clean at 11. Fixed in PR #47 (force UTF-8 + treat empty report as scan error). Real items: a head.ref workflow shell-injection, a 6-CVE React Router frontend lockfile (no Dependabot), a Helm chart default password, nginx hardening
• 2026-06-10 — Ar9av/obsidian-wiki — 0 findings literally (sixth clean scan in the series, and the cleanest in raw count). Manual semgrep re-run confirmed results: 0, errors: 0. Architecture is “thin installer CLI + delegated Claude Code skills” — the agent intelligence lives in skill markdown the scanner doesn’t read, leaving almost nothing to fire on
• 2026-06-09 — confident-ai/deepteam — 48 findings, zero real in-scope runtime items; 5th clean scan in the series. Gitleaks hits were intentional OSS-telemetry write-only keys (PostHog phc_… + New Relic OTLP license); the 24-CVE trivy tail split between an out-of-scope Docusaurus docs/yarn.lock and a Python poetry.lock whose Dependabot was already on the job · post-only, no issue filed
• 2026-06-08 — 54yyyu/zotero-mcp — 4 scanner findings → 6 confirmed-real curated items, only 1 of which came from the scanner. First scan run under the project’s ultracode mode (23-agent parallel completeness sweep across MCP-specific surfaces). Headline: medium SSRF in OA-PDF discovery reachable via prompt injection + medium plaintext ZOTERO_API_KEY stdout dump (discipline break — same function obfuscates 25 lines earlier) + 4 hardening lows. The strongest “scanner alone undercounts MCP-specific surface” demonstration in the series. · ✅ All six items fixed and merged ~6h later in PRs #327 + #328; v0.5.0 cut 9 min after issue close. Maintainer explicitly credited the adversarial-verification methodology.
• 2026-06-06 — LazyAGI/LazyLLM — 121 findings, series record for the pull_request_target cluster (16 sites in one workflow), Gradio ×3 + DeepSpeed RCE dep tail, classic eval()-based Calculator agent tool; two highest-severity items disclosed privately to a corporate maintainer address (SenseTime backing) — no public courtesy issue, post-only
• 2026-06-04 — agentscope-ai/ReMe — 159 findings, 3 concrete items filed (wildcard CORS + credentials on both HTTP-service entrypoints, chromadb CVE, Neo4j password="neo4j" default) · largest SQL-identifier cluster in the series so far (139 sites across 3 vector/file-store backends) + a new flow-DSL exec/eval-with-restricted-globals shape to watch · ✅ All three items fixed in reme4/ ~13h later (item-by-item response)
• 2026-06-03 — Q00/ouroboros — 34 findings, third “deps-are-the-thing” scan in a row (after MemoryBear & agency-swarm) — litellm 7-advisory stack + anthropic 2-pair reported privately via the published SECURITY.md channel · ✉️ Maintainer triaged within 48h SLA: all advisories are genuine version-matches but none reachable in Ouroboros’s library-only usage (no LiteLLM Proxy, no anthropic memory-tool feature); coordinated refresh scheduled; post corrected for the surface conflation 2026-06-08
• 2026-06-02 — VRSEN/agency-swarm — 48 findings, auth-tier dep concentration that fits the project’s shape: authlib 1 critical + 3 auth-bypass highs and fastmcp 1 critical SSRF + OAuth pile, on a multi-agent OAuth/MCP framework with no Dependabot · the recurring shell=True-in-agent-shell-tool by-design class · ✅ Resolved 2026-06-04 in PR #659 (~15h)
• 2026-06-01 — SuanmoSuanyangTechnology/MemoryBear — 196 findings, 3 named critical CVEs in a stale api/uv.lock (pytorch RCE-class, fastmcp SSRF, nltk Zip Slip) on a repo with no Dependabot · 37× Jinja2-for-LLM-prompts is the new rule-misfit class of the series · 📝 Maintainer acknowledged + closed 2026-06-12 with intent to review + add Dependabot (no fix landed yet)
• 2026-05-29 — homeassistant-ai/ha-mcp — 65 findings, zero real in-scope items; a strict-norm repo whose maintainer published a precise threat model — every scary finding is a fixture, an intentional public demo token, a documented by-design decision, or an FP · post-only, no issue filed
• 2026-05-28 — evalstate/fast-agent — 36 findings, near-clean scan where the maintainer already hand-rolled the hard mitigations (a tar-traversal guard, a filename sanitizer before a shell call); actionable surface is two defense-in-depth hardenings + a Dependabot-lane requests CVE pair · ✅ Both hardenings adopted in v0.7.13 the same day (~8h)
• 2026-05-27 — aurelio-labs/semantic-router — 116 findings, cleanest two-person-team scan in the series; entire actionable surface is 50 SQL-identifier sites in one Postgres-backend file + a 30-advisory dep-drift tail
• 2026-05-27 — pixeltable/pixeltable — 67 findings, first scan to surface a CVE-2007-4559-shape tarfile.extractall finding on a code path that imports user-shared bundles; plus the recurring 26-site SQL-identifier class in the catalog layer · ✅ PR #1378 (filter='data') merged 2026-06-07 (~11 days, silent merge after CI review)
• 2026-05-26 — dstackai/dstack — 163 findings, 3 real critical Go CVEs in the runner (SSH PublicKeyCallback auth-bypass, Moby AuthZ bypass, go-git argument injection) + 21 workflow-injection patterns (series-high) · ❌ Issue declined by maintainer for disclosure-format reasons; honest record kept
• 2026-05-26 — pydantic/logfire — 27 findings, third clean scan in the series; every eval/exec/pickle finding is a deliberate language-feature use that an observability library structurally needs
• 2026-05-25 — MinishLab/semble — 2 findings, second clean scan in the series (after Giskard); a small focused library with two hyper-responsive maintainers
• 2026-05-25 — plastic-labs/honcho — 315 findings, real cluster on the MCP server’s Hono framework (~9 CVEs incl. auth bypass) + a critical basic-ftp in the docs-site lockfile; first scan where logger-credential-leak hit five-for-five FPs across the series
• 2026-05-21 — HolmesGPT/holmesgpt — 2,143 findings, 93% are an SRE agent’s deliberately-broken Kubernetes test fixtures; real signal is 17 workflow-injection patterns + a drifted experimental/ front-end
• 2026-05-21 — dograh-hq/dograh — 69 findings, one dominant cluster (outdated Next.js across two front-ends, incl. middleware-bypass advisories) + a fail-open OSS_JWT_SECRET default · ✅ 3 of 4 PRs merged by nuthalapativarun (2026-05-27); issue closed
• 2026-05-20 — Klavis-AI/klavis — 1,556 findings (largest scan in the series), 22 critical dependency CVEs incl. authlib auth-bypass + fastmcp SSRF; a case study in monorepo dependency drift across 50+ MCP servers
• 2026-05-20 — Giskard-AI/giskard-oss — 27 findings, all false positives — first clean scan in the series; a teardown of pull_request_target done right vs the airweave finding
• 2026-05-19 — guardrails-ai/guardrails — 17 findings, first dep-scan hits in the series (7 known CVEs on a pinned litellm upper bound) + 2× duplicated unverified-jwt-decode + 4× workflow inputs interpolation
• 2026-05-19 — airweave-ai/airweave — 46 findings, ~4 publishable best-practice items + 1 disclosed privately via SECURITY.md email channel, ~30 false positives or intentional-by-design patterns
• 2026-05-16 — MervinPraison/PraisonAI — 489 raw findings (largest scan yet), 5 real items, first validation of the --ignore-file workflow on a fresh target · ✅ All five resolved in PR #1677 by their praisonai-triage-agent bot + human review (merged 2026-05-19)
• 2026-05-15 — Upsonic/Upsonic — 40 findings, 4 real items across SSL/SQL/subprocess/pickle, ~36 false positives or by-design patterns
• 2026-05-15 — msoedov/agentic_security — 9 findings, 2 real best-practice items + 1 disclosed privately, 6 false positives or out-of-scope
• 2026-05-14 — traceloop/openllmetry — 33 findings, 25 false-positive secrets in test cassettes, 1 best-practice item filed with the maintainer
• 2026-05-14 — gptme/gptme — 57 findings, 3 best-practice improvements filed with the maintainer · ✅ All three resolved in PR #2399 (merged 2026-05-15)

---

About AI PatchLab

AI PatchLab is a Python CLI that produces JSON and Markdown security reports from a local repository path. It is designed for engineers and maintainers who want a real audit without sending their codebase to a cloud service.

• Source: github.com/elfrost/ai-patchlab
• Built on top of Semgrep, Gitleaks, Trivy, and pip-audit
• AI review is disabled by default and local-first when opted in

For setup and full documentation, see the project README.