CipherNest

Open Source AI Application Security Platform

Most security tools were built before AI agents existed.
CipherNest was built for the world where your code ships with an LLM attached to a database.

Why CipherNest?

Most security tools stop at source code.

CipherNest secures the entire AI application stack.

from a single security engine.

Screenshots

Security Dashboard

Attack Graph

NPM Shield

Agent Permission Map

Comparison

Quick start

npx ciphernest scan .
ciphernest benchmark .

Add CipherNest to any AI agent through MCP:

{
  "mcpServers": {
    "ciphernest": {
      "command": "npx",
      "args": ["-y", "@ciphernest/mcp-server"]
    }
  }
}

What CipherNest covers

Run anywhere

CipherNest is a monorepo. All scanner logic lives once in @ciphernest/core. Every client is a thin wrapper.

CLI

npx ciphernest scan .

  ╔═══════════════════════════════╗
  ║   CipherNest Security Scanner  ║
  ╚═══════════════════════════════╝

── CODE ──────────────────────────────
[CRITICAL] CODE001  Dangerous eval()
  src/api.ts:42
  Fix: Replace eval() with JSON.parse() or safer alternatives

── SECRET ──────────────────────────────
[CRITICAL] SEC001  OpenAI API Key
  config.ts:7  sk-proj-ab***REDACTED***

── LLM ──────────────────────────────
[HIGH    ] LLM001  Direct Prompt Injection Risk
  src/chat.ts:18

12 finding(s)  6 critical  6 high  0 medium

Security Grade: C  (score: 65/100)
✅ PASS — no findings at or above high severity

Options:

ciphernest scan .                          # table output (default)
ciphernest scan . --format json            # JSON output
ciphernest scan . --format sarif           # SARIF for GitHub Code Scanning
ciphernest scan . --severity high          # only high and above
ciphernest scan . --fail-on critical       # exit 1 only on critical
ciphernest scan . --no-llm --no-agent      # skip specific scanners

GitHub Action

- name: CipherNest Security Scan
  uses: ciphernest/scan-action@v1

- name: Upload SARIF to Code Scanning
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: ciphernest-results.sarif

On every pull request, CipherNest posts:

• Inline annotations in the diff (red for critical/high, yellow for medium)
• A PR comment with the security grade and scanner breakdown
• A SARIF file for GitHub Code Scanning integration

## 🟠 CipherNest Security Scan

Security Grade: B  (82/100)

| Severity | Count |
|----------|-------|
| 🔴 Critical | 0 |
| 🟠 High | 2 |
| 🟡 Medium | 5 |

### Top Findings

| Rule     | Severity | Name                      | Location        |
|----------|----------|---------------------------|-----------------|
| `LLM001` | 🟠 high  | Direct Prompt Injection   | `chat.ts:18`    |
| `CICD002`| 🟠 high  | Unpinned GitHub Action    | `ci.yml:14`     |

Action inputs:

- uses: ciphernest/scan-action@v1
  with:
    path: "."
    severity: "low"
    fail-on: "high"
    post-pr-comment: "true"
    sarif-output: "ciphernest-results.sarif"

MCP Server

Add CipherNest to any AI agent — Claude Desktop, Cursor, Windsurf, LangGraph, Mastra, OpenAI Agents:

{
  "mcpServers": {
    "ciphernest": {
      "command": "npx",
      "args": ["-y", "@ciphernest/mcp-server"]
    }
  }
}

Available tools:

VS Code Extension

Install from the marketplace or:

code --install-extension ciphernest-0.7.0.vsix

Findings appear inline as diagnostics. Open the CipherNest sidebar for the tree view, score, and attack graph.

Architecture

Every product surface uses the same scanner, rules, scoring, policy, and attack-graph engine.

packages/
├── core/             @ciphernest/core — single source of truth for all scan logic
│   └── src/
│       ├── engine.ts        SecurityEngine orchestrator
│       ├── types.ts         Finding, SecurityScore, Severity, ScanInput
│       ├── rules/           codeRules, llmRules, secretRules, agentRules
│       ├── scanners/        All scanners (vscode-agnostic)
│       ├── scoring/         scoreEngine — A–F grade
│       ├── policy/          policyEngine — .ciphernest.json
│       ├── attackGraph/     graphBuilder — Mermaid diagrams
│       └── npmShield/       supply chain scanner
│
├── cli/              ciphernest — npm binary
├── github-action/    ciphernest/scan-action — SARIF + PR comments
└── mcp-server/       @ciphernest/mcp-server — MCP tools for AI agents

src/                  VS Code extension — thin adapters over @ciphernest/core

Policy as code

Configure with .ciphernest.json at the project root:

{
  "version": 1,
  "severityThreshold": "low",
  "enabledScanners": ["code", "llm", "secret", "dependency", "mcp", "agent"],
  "disabledRules": ["CODE014"],
  "severityOverrides": { "SEC010": "high" },
  "excludePatterns": ["**/node_modules/**", "**/*.test.ts"],
  "ciFailThreshold": "high",
  "ciMaxFindings": 0,
  "complianceFrameworks": ["gdpr", "hipaa", "pci", "dpdp"],
  "approvedLLMProviders": ["openai", "anthropic"],
  "autoScanOnOpen": true,
}

Generate a scaffold: CipherNest: Create .ciphernest.json Policy

Scoring

Deductions: Critical = 25 pts · High = 10 pts · Medium = 4 pts · Low = 1 pt. Per-scanner cap prevents one noisy scanner from zeroing the overall score.

Benchmark results

Run the AI application security benchmark:

ciphernest benchmark .

Prompt Injection Score      91  ████████████████████░  A
Agent Security Score        88  ████████████████████░  B+
MCP Security Score          93  █████████████████████  A
Supply Chain Score          84  ████████████████████░  B
Infrastructure Score        81  ███████████████████░░  B-

Overall Security Score      87  Grade: B+

Rule reference

Platform roadmap and extensions

GitHub App

Not an Action — an App. Inline PR comments per finding, like CodeQL and SonarQube:

LLM001 — Prompt Injection Risk

User input passed to LLM without sanitization on line 42.
Attacker can override system instructions and gain tool access.

Suggested fix:
  sanitizeInput(userMessage) before passing to chain.invoke()

Runtime MCP Gateway

Move from scan-before-deploy to monitor-while-running. A proxy layer that intercepts MCP tool calls before they execute:

Agent
  ↓
CipherNest Gateway
  ↓  (inspects: tool name, parameters, calling context)
Tool

Blocks: delete operations, exfiltration patterns, privilege escalation, prompt injection in tool output.

Security Reasoning Engine

Move from rules → findings to rules → findings → explanation:

Current:  LLM001 detected at chat.ts:42

Future:   Prompt injection at chat.ts:42.
          Attacker controlling user_input can override the system prompt,
          gain access to the file_write tool registered at agents.ts:17,
          and exfiltrate /etc/passwd via the HTTP callback in tools.ts:91.
          Business impact: complete agent compromise, data breach.

Marketplace rules (packages/rules)

Rules extracted into a standalone package so the community can contribute and enterprises can buy packs:

npm install @ciphernest/rules-enterprise
npm install @ciphernest/rules-hipaa
npm install @ciphernest/rules-pci

Security

• Threat Model → docs/threat-model.md
• Security Policy → SECURITY.md
• Responsible Disclosure → SECURITY.md

Triage and suppression

Suppress a false positive with a tracked reason:

CipherNest: Suppress Finding

All suppressions are stored in .ciphernest-suppressions.json and visible in the triage report. The audit log captures every suppression with timestamp and author.

License

MIT © Vairamuthu