cyrius44/security-review repository overview

⁠security-review

Security code review server for AI coding agents, built on the Model Context Protocol (MCP). It provides review prompts, checklists, a pattern scanner, dependency analysis against OSV advisories, and stored reports, plus a web interface and a CI gate.

📖 Documentation: https://cyr-ius.github.io/security-review/⁠ 💻 Source: https://github.com/cyr-ius/security-review⁠

⁠One image, two processes

The two processes share one database:

Available for linux/amd64 and linux/arm64. Works with SQLite or PostgreSQL. The container runs as a non-root user (UID 10001) and includes an SBOM and a provenance attestation.

⁠Tags

Also published as ghcr.io/cyr-ius/security-review.

⁠Quick start (Docker Compose with PostgreSQL)

mkdir security-review && cd security-review
curl -fsSLO https://raw.githubusercontent.com/cyr-ius/security-review/master/examples/docker/docker-compose.yml
(umask 077 && printf 'POSTGRES_PASSWORD=%s\nSECREVIEW_SECRET_KEY=%s\n' "$(openssl rand -hex 24)" "$(openssl rand -hex 32)" > .env)
docker compose up -d --wait
docker compose exec controller security-review-controller user reset-password admin   # admin password
docker compose exec controller security-review-controller token create --label alice   # agent token

• Web interface: http://127.0.0.1:8080/ui/
• MCP endpoint: http://127.0.0.1:8000/mcp

The ports only listen on 127.0.0.1. Before you open them to your team, enable TLS or put a reverse proxy in front. See the Docker guide⁠ for running without Compose, backups and upgrades.

⁠License

See the repository⁠.