Runs static code scans and audits agent skills or MCP configuration for suspicious instructions. Its stdio tools return findings with locations, rule explanations and suggested remediation. The scanner works offline; installing packages can use the network and report options can write files. Findings and grades cover only the examined rules and files and are not a security certification. Release v2.1.0 published November 9, 2026 (UTC).