Caspian Security
One security scanner — in VS Code, any terminal, your AI agent, and CI.
About
A security scanner for code and infrastructure — 309 rules with intra-file taint tracking, confidence scoring, and opt-in AI fixes. It catches vulnerabilities across 8 languages (SSRF, XXE, SSTI, SQL injection, deserialization, JWT/OAuth misconfigurations), insecure Dockerfile / Terraform / Kubernetes config, hardcoded secrets (28 provider-prefix detectors, including leaks buried in git history), and vulnerable dependencies via OSV.dev. The same rule engine runs everywhere — inline in VS Code, as a standalone CLI in any terminal, inside AI coding agents via MCP, and in CI via a reusable GitHub Action — so results are identical wherever it runs.
How to use it
In VS Code
Install the extension from the Marketplace. It analyzes files as you type — findings appear inline with confidence scores and one-click quick fixes, no AI round-trip needed.
In any terminal
No VS Code needed — the same engine ships as an npm package with a standalone caspian CLI. Run it one-off with npx, or install it globally:
npx -y caspian-security caspian scan . # or install once, then use anywhere npm install -g caspian-security
caspian scan . # main scanner — SARIF / JSON / text output caspian git-history . # walk git history for leaked secrets caspian check-updates # npm audit + stack version checks (--osv adds OSV.dev scan) caspian --help # full command list
The default output format is SARIF, so GitHub’s upload-sarif action can consume it directly. To read results yourself, use --format text for a report grouped by file, or add --output results.json to write to a file instead of the terminal. Exit codes are CI-friendly: 0 = clean, 1 = findings at or above the --fail-on threshold, 2 = scan error.
In AI coding agents
caspian mcp runs a stdio MCP server exposing scan, scan_git_history, list_rules, and explain_rule tools. Register it with Claude Code (or add the same command to any MCP-capable agent):
claude mcp add caspian-security -- npx -y caspian-security caspian mcp
Prefer plain instructions over MCP? caspian snippet --agent claude --mode after-edits prints a paste-ready block for your CLAUDE.md that tells the agent to scan automatically after editing files.
In CI
A reusable GitHub Action (.github/actions/scan in the repo) scans on every push and uploads SARIF findings straight to your repository’s Security tab.
Updates
No updates published yet.
Latest release
The Security Tasks checklist now opens as a full editor tab. Previously it existed only in the narrow activity-bar column, where task titles and dates were truncated and there was no way to open it anywhere else. ### Added - **"Open Security Tasks in Editor" title-bar button** on the Security Tasks view — the `$(preview)` icon next to Refresh opens the checklist as a full editor tab, matching the affordance in Caspian Taskmaster and Caspian Notes. Clicking it again reveals the existing tab rather than opening a duplicate. - **Editor-tab layout** for the checklist: titles and metadata wrap instead of being cut off with an ellipsis, groups get roomier spacing, and content is centred in a readable column. The sidebar rendering is unchanged. - Both surfaces render from one shared template and stay live-synced from the same `TaskStore` — completing or refreshing a task updates the sidebar and the editor tab at once. ### Changed - **`Caspian Security: Show Security Tasks` is now `Caspian Security: Open Security Tasks in Editor`** and opens the editor tab instead of re-focusing the sidebar. This also upgrades the two places that already linked to it: the tasks link in the Results panel, and the **Show Tasks** button on the overdue-task notification. - Security Tasks title-bar buttons now use explicit ordering (`navigation@1` Refresh, `navigation@2` Open in Editor). ### Fixed - `TaskChecklistViewProvider` no longer carried a private copy of `getNonce()` — it now uses the shared helper in `webviewUtils.ts`. --- **Install:** https://marketplace.visualstudio.com/items?itemName=CaspianTools.caspian-securityView release on GitHub →