AI PatchLab Scans
Security scans of public repositories run with AI PatchLab, an open-source, local-first security scanner.
Every report on this page was generated locally. No source code was sent to any third party, no AI provider was contacted, and no paid API was called. AI PatchLab orchestrates Semgrep, Gitleaks, Trivy, and pip-audit, then applies deterministic remediation and confidence rules to normalize the findings.
Want this run privately against your own codebase? I do independent security review of AI agents, MCP servers, and LLM apps — work with me →. 112 scans, 26 confirmed fixes, methodology in the open.
OpenAI just launched Daybreak and Patch the Planet. Same remediation loop, opposite trade-off: their path is a cloud frontier model; this one keeps your code on your disk. Why local-first still matters →
New — the whole series, read end to end. Measured across the first 83 scans: the four tools produced 10,635 findings; 56 were real. Here is what they reliably get wrong, the six classes of bug no rule can see, and why half the scans found nothing. 10,635 findings, 56 that mattered →
Two shorter ways in
- Findings a maintainer fixed — the 26 that resolved upstream. The shortest version of the argument: a report is only worth writing if someone can act on it.
- Scans that found nothing — 40 of them, published as they ran. A method that can only return “yes” is not a method.
Six scans worth reading
If you only read a handful, read these. Each one shows a different part of the job — and the last two show it going against the interesting answer, which is the part that makes the other 81 worth trusting.
jgravelle/jcodemunch-mcp — a finding concrete enough to be adopted. A path-confinement escape, reported with a working fix. The pull request never merged — a contributor licence agreement expired first — so the maintainer wrote the diff themselves and said so in the release notes. Catching the bug by resolution rather than by pattern exposed that the same rule already had three separate spellings in the codebase; there is one now, with a test that fails on a fourth.
EvoScientist/EvoScientist — the finding no tool ranked. An inverted conditional meant two webhook channels verified their signature only when a caller-controlled flag asked them to. Thirty-nine findings in the report; this was not one of them. A passer-by contributor reproduced the bypass on both channels and shipped the fix with nine regression tests.
54yyyu/zotero-mcp — curation is the product. Four scanner findings became six confirmed-real items, and only one of the six came from a scanner. All six were fixed and merged about six hours later; the next release was cut nine minutes after the issue closed.
whiteguo233/OpenBiliClaw — when two tools disagree, the disagreement is the finding. Trivy read the lockfile and reported 63 advisories; pip-audit resolved the same project’s declared version floors and reported zero. Both were right. The project ships both as real install paths, so the containerised deployment was clean and the recommended host install was not — from the same commit. Fixed and merged the same day, as the single-package bump the issue asked for rather than a blanket lockfile refresh.
TracecatHQ/tracecat — a negative result, published. A security-automation platform, scanned the same way as everything else, with every promising lead followed to a dead end. Nothing real to report, so that is what the write-up says. A method that can only return “yes” is not a method.
Mai-with-u/MaiBot — the fifty-two findings that weren’t. An automated sweep flagged 52 of 404 routes as unauthenticated, including an entire router that visibly lacked the dependency its siblings all carried. Reading the code dissolved it: the module imported the auth function under an alias and called it in the handler body. Of the 404 routes, 378 enforce auth and the 9 genuinely public ones are health, version, robots, login and static assets. Fifty-two flagged, none reported.
How these scans work
- Each scan targets a public repository at a specific commit.
- Findings are curated: noise filtered out, top items highlighted.
- Critical issues are reported to maintainers under responsible disclosure before being published here in full detail.
- Where a project’s security policy forbids public vulnerability reports, the finding is withheld from this page too — those rows read private, or undelivered where no private channel turned out to exist.
- Posts focus on patterns and lessons — not exploit walkthroughs.
All scans
112 scans, newest first. Findings is the raw count the tools produced; Real is what survived curation. The gap between those two columns is the entire job.
Outcome reads: fixed — the maintainer shipped a fix; accepted — a private advisory was accepted into triage but no fix has shipped yet; open — reported publicly and still open; declined — the maintainer considered it and said no, and the write-up quotes their reasoning; private — reported through a private channel and withheld here until it resolves; undelivered — no private channel existed at all, so the report could not be delivered and the detail stays withheld indefinitely; partial — only part of a multi-item report landed; — — nothing was filed, which is the usual outcome of a clean scan.
| Date | Repository | Findings | Real | Outcome |
|---|---|---|---|---|
| 2026-09-28 | fossasia/voxbento | 168 | 0 first-party — dependency | — |
| 2026-09-24 | superdesigndev/treg | 96 | 1 real — withheld | private |
| 2026-09-23 | can4hou6joeng4/boss-agent-cli | 26 | 1 real — withheld | private |
| 2026-09-22 | overwirehq/claude-code-telegram | 54 | 0 first-party — dependency | — |
| 2026-09-21 | HarnessRouter/harnessrouter | 117 | 1 real — dependency | — |
| 2026-09-20 | TencentCloud/Octop | 300 | 1 real — withheld | private |
| 2026-09-19 | hydropix/TranslateBooksWithLLMs | 55 | 1 real — withheld | private |
| 2026-09-15 | experientiallabs/experiential | 77 | 1 real — withheld | private |
| 2026-09-14 | superlinked/sie | 156 | 1 real | fixed |
| 2026-09-13 | bubbuild/bub | 72 | 1 real | declined |
| 2026-09-12 | langroid/langroid | 132 | 0 real | — |
| 2026-09-11 | mljar/mercury | 140 | 1 real — withheld | accepted |
| 2026-09-10 | Datus-ai/Datus-agent | 291 | 1 real | open |
| 2026-09-09 | mims-harvard/ToolUniverse | 284 | 1 real — withheld | private |
| 2026-09-08 | chigwell/telegram-mcp | 38 | 0 real | — |
| 2026-09-07 | realiti4/claude-swap | 22 | 0 real | — |
| 2026-09-06 | ApodexAI/FrontierAgent | 58 | 1 real — withheld | private |
| 2026-09-05 | doobidoo/mcp-memory-service | 176 | 0 real | — |
| 2026-09-04 | basicmachines-co/basic-memory | 270 | 0 real | — |
| 2026-09-03 | samuelgursky/davinci-resolve-mcp | 97 | 1 real | fixed |
| 2026-09-02 | HKUDS/OpenOPC | 56 | 1 real — withheld | private |
| 2026-09-01 | future-agi/future-agi | 1227 | 1 real — withheld | private |
| 2026-08-31 | shy3130/tick-stock-panel | 77 | 1 real | fixed |
| 2026-08-30 | SenteLabsAI/OpenExecutive | 124 | 1 real — withheld | private |
| 2026-08-29 | ginlix-ai/LangAlpha | 372 | 1 real | fixed |
| 2026-08-28 | Ontos-AI/knowhere | 129 | 1 real — withheld | private |
| 2026-08-27 | Zleap-AI/SAG | 60 | 1 real | fixed |
| 2026-08-26 | ascending-llc/jarvis-registry | 235 | 1 real — withheld | private |
| 2026-08-25 | langflow-ai/openrag | 213 | 1 real — withheld | private |
| 2026-08-20 | whiteguo233/OpenBiliClaw | 373 | 1 real | fixed |
| 2026-08-19 | Mai-with-u/MaiBot | 373 | 1 real — withheld | private |
| 2026-08-18 | roflcoopter/viseron | 399 | 1 real — withheld | private |
| 2026-08-17 | zilliztech/memsearch | 90 | 1 real | fixed |
| 2026-08-16 | liaohch3/claude-tap | 104 | 1 real — withheld | undelivered |
| 2026-08-15 | TracecatHQ/tracecat | 212 | 0 real | — |
| 2026-08-14 | datalayer/jupyter-mcp-server | 37 | 0 real | private |
| 2026-08-13 | lightseekorg/tokenspeed | 181 | 1 real — withheld | private |
| 2026-08-12 | jgravelle/jcodemunch-mcp | 49 | 0 real | fixed |
| 2026-08-11 | semantica-agi/Semantica | 60 | 1 real — withheld | private |
| 2026-08-10 | datascale-ai/OpenTalking | 93 | 1 real | — |
| 2026-08-09 | NeptuneHub/AudioMuse-AI | 265 | 1 real — withheld | private |
| 2026-08-08 | theroyallab/tabbyAPI | 18 | 2 real | fixed |
| 2026-08-07 | huangruiteng/loopx | 57 | 1 real — withheld | fixed |
| 2026-08-06 | nottelabs/notte | 226 | 1 real — withheld | private |
| 2026-08-05 | Vexa-ai/vexa | 297 | 1 real — withheld | private |
| 2026-08-04 | ArcReel/ArcReel | 82 | 1 real — withheld | fixed |
| 2026-08-03 | the-momentum/open-wearables | 145 | 2 real | fixed |
| 2026-08-02 | Observal/Observal | 1,117 | 1 real — withheld | private |
| 2026-08-01 | repowise-dev/repowise | 86 | 2 real — withheld | private |
| 2026-07-31 | rocketride-org/rocketride-server | 268 | 1 real — withheld | private |
| 2026-07-30 | pipeshub-ai/pipeshub-ai | 389 | 2 real — withheld | private |
| 2026-07-29 | Project-N-E-K-O/N.E.K.O | 783 | 1 real | fixed |
| 2026-07-28 | EvoScientist/EvoScientist | 39 | 1 real | fixed |
| 2026-07-27 | dimensionalOS/dimos | 280 | 0 real | — |
| 2026-07-26 | CodeGraphContext/CodeGraphContext | 112 | 0 real | — |
| 2026-07-25 | Osmantic/ODS | 73 | 0 real | — |
| 2026-07-24 | gpustack/gpustack | 136 | 0 real | — |
| 2026-07-23 | EverMind-AI/Raven | 87 | 0 real | — |
| 2026-07-22 | mixelpixx/KiCAD-MCP-Server | 29 | 0 real | — |
| 2026-07-21 | ucbepic/docetl | 124 | 1 real | — |
| 2026-07-20 | ModelEngine-Group/nexent | 115 | 0 real | — |
| 2026-07-19 | vitali87/code-graph-rag | 22 | 1 real | fixed |
| 2026-07-18 | algorithmicsuperintelligence/optillm | 57 | 1 real | — |
| 2026-07-17 | IBM/mcp-context-forge | 946 | 0 real | — |
| 2026-07-16 | a2aproject/a2a-python | 20 | 0 real | — |
| 2026-07-15 | mnemosyne-oss/mnemosyne | 195 | 0 real | — |
| 2026-07-14 | datachain-ai/datachain | 35 | 0 real | — |
| 2026-07-13 | potpie-ai/potpie | 96 | 0 real | — |
| 2026-07-10 | sooperset/mcp-atlassian | 71 | 0 real | — |
| 2026-07-09 | VectifyAI/OpenKB | 23 | 0 real | — |
| 2026-07-07 | atilaahmettaner/tradingview-mcp | 28 | 0 real | — |
| 2026-07-03 | AgentEra/Agently | 25 | 1 real | fixed |
| 2026-07-02 | UKGovernmentBEIS/inspect_ai | 161 | 0 real | — |
| 2026-07-01 | Soju06/codex-lb | 76 | 0 real | — |
| 2026-06-30 | openagents-org/openagents | 680 | 0 real | — |
| 2026-06-28 | SwanHubX/SwanLab | 32 | 0 real | — |
| 2026-06-26 | ag2ai/ag2 | 73 | 0 real | — |
| 2026-06-25 | Kiln-AI/Kiln | 150 | 0 real | — |
| 2026-06-24 | maziyarpanahi/openmed | 44 | 0 real | — |
| 2026-06-23 | stickerdaniel/linkedin-mcp-server | 6 | 0 real | — |
| 2026-06-21 | taylorwilsdon/google_workspace_mcp | 16 | 0 real | — |
| 2026-06-19 | xerrors/Yuxi | 70 | see write-up | fixed |
| 2026-06-15 | harbor-framework/harbor | 570 | see write-up | — |
| 2026-06-12 | mistralai/mistral-vibe | 21 | 0 real | — |
| 2026-06-11 | dataelement/Clawith | 54 | see write-up | — |
| 2026-06-10 | Ar9av/obsidian-wiki | — | 0 real | — |
| 2026-06-09 | confident-ai/deepteam | 48 | 0 real | — |
| 2026-06-08 | 54yyyu/zotero-mcp | 4 | 6 real | fixed |
| 2026-06-06 | LazyAGI/LazyLLM | 121 | see write-up | — |
| 2026-06-04 | agentscope-ai/ReMe | 159 | 3 real | fixed |
| 2026-06-03 | Q00/ouroboros | 34 | see write-up | — |
| 2026-06-02 | VRSEN/agency-swarm | 48 | see write-up | fixed |
| 2026-06-01 | SuanmoSuanyangTechnology/MemoryBear | 196 | see write-up | — |
| 2026-05-29 | homeassistant-ai/ha-mcp | 65 | 0 real | — |
| 2026-05-28 | evalstate/fast-agent | 36 | 0 real | fixed |
| 2026-05-27 | aurelio-labs/semantic-router | 116 | see write-up | partial |
| 2026-05-27 | pixeltable/pixeltable | 67 | see write-up | fixed |
| 2026-05-26 | dstackai/dstack | 163 | 3 real | — |
| 2026-05-26 | pydantic/logfire | 27 | 0 real | — |
| 2026-05-25 | MinishLab/semble | 2 | 0 real | — |
| 2026-05-25 | plastic-labs/honcho | 315 | see write-up | — |
| 2026-05-21 | HolmesGPT/holmesgpt | 2,143 | see write-up | — |
| 2026-05-21 | dograh-hq/dograh | 69 | see write-up | fixed |
| 2026-05-20 | Klavis-AI/klavis | 1,556 | see write-up | — |
| 2026-05-20 | Giskard-AI/giskard-oss | 27 | 0 real | — |
| 2026-05-19 | guardrails-ai/guardrails | 17 | see write-up | — |
| 2026-05-19 | airweave-ai/airweave | 46 | see write-up | — |
| 2026-05-16 | MervinPraison/PraisonAI | 489 | 5 real | fixed |
| 2026-05-15 | Upsonic/Upsonic | 40 | 4 real | — |
| 2026-05-15 | msoedov/agentic_security | 9 | 2 real | fixed |
| 2026-05-14 | traceloop/openllmetry | 33 | 1 real | — |
| 2026-05-14 | gptme/gptme | 57 | 3 real | fixed |
Older entries predate the “N real” convention and are marked “see write-up”. Every scan’s original summary is preserved in the full scan log.
About AI PatchLab
AI PatchLab is a Python CLI that produces JSON and Markdown security reports from a local repository path. It is designed for engineers and maintainers who want a real audit without sending their codebase to a cloud service.
- Source: github.com/elfrost/ai-patchlab
- Built on top of Semgrep, Gitleaks, Trivy, and pip-audit
- AI review is disabled by default and local-first when opted in
For setup and full documentation, see the project README.