<!DOCTYPE html>
<html lang="en" style="scroll-behavior:smooth">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>mycop — AI Code Security Scanner</title>
<meta name="description"
content="Detect and auto-fix vulnerabilities in AI-generated code. 100 built-in security rules, 5 AI providers, SARIF output. Open source.">
<link rel="icon" type="image/svg+xml" href="favicon.svg">
<link rel="icon" type="image/png" href="favicon.png">
<link rel="canonical" href="https://abdumajidrashidov.github.io/mycop/">
<meta name="theme-color" content="#0066ff">
<!-- Open Graph -->
<meta property="og:title" content="mycop — AI Code Security Scanner">
<meta property="og:description" content="Detect and auto-fix vulnerabilities in AI-generated code. 100 built-in security rules covering OWASP Top 10 & CWE Top 25. Supports Python, JavaScript, and TypeScript.">
<meta property="og:type" content="website">
<meta property="og:url" content="https://abdumajidrashidov.github.io/mycop/">
<meta property="og:image" content="https://abdumajidrashidov.github.io/mycop/og-image.png">
<meta property="og:image:width" content="1200">
<meta property="og:image:height" content="630">
<meta property="og:image:alt" content="mycop — AI Code Security Scanner for Python, JavaScript, and TypeScript">
<meta property="og:site_name" content="mycop">
<meta property="og:locale" content="en_US">
<!-- Twitter Card -->
<meta name="twitter:card" content="summary_large_image">
<meta name="twitter:title" content="mycop — AI Code Security Scanner">
<meta name="twitter:description" content="Detect and auto-fix vulnerabilities in AI-generated code. 100 built-in rules, SARIF output, zero config.">
<meta name="twitter:image" content="https://abdumajidrashidov.github.io/mycop/og-image.png">
<!-- Structured Data: SoftwareApplication -->
<script type="application/ld+json">
{
"@context": "https://schema.org",
"@type": "SoftwareApplication",
"name": "mycop",
"description": "AI Code Security Scanner — detect and auto-fix vulnerabilities in AI-generated code. 100 built-in security rules covering OWASP Top 10 and CWE Top 25.",
"applicationCategory": "DeveloperApplication",
"applicationSubCategory": "Security Scanner",
"operatingSystem": "macOS, Linux, Windows",
"softwareVersion": "0.3.0",
"programmingLanguage": "Rust",
"downloadUrl": "https://crates.io/crates/mycop",
"installUrl": "https://github.com/AbdumajidRashidov/mycop#installation",
"url": "https://abdumajidrashidov.github.io/mycop/",
"license": "https://opensource.org/licenses/MIT",
"isAccessibleForFree": true,
"offers": {
"@type": "Offer",
"price": "0",
"priceCurrency": "USD"
},
"featureList": [
"100 built-in security rules covering OWASP Top 10 and CWE Top 25",
"AI-powered auto-fix with Claude, GPT-4, and Ollama support",
"Python, JavaScript, and TypeScript scanning",
"SARIF, JSON, and terminal output formats",
"GitHub Actions integration",
"Pre-commit hook support",
"AST-level analysis with tree-sitter",
"Configurable severity thresholds",
"Git diff scanning mode",
"MCP server for agentic tool integration (Claude Code, Cursor, Windsurf, Codex CLI)"
],
"author": {
"@type": "Person",
"name": "Abdumajid Rashidov",
"url": "https://github.com/AbdumajidRashidov"
},
"codeRepository": "https://github.com/AbdumajidRashidov/mycop",
"sameAs": [
"https://github.com/AbdumajidRashidov/mycop",
"https://crates.io/crates/mycop"
]
}
</script>
<!-- Structured Data: FAQPage -->
<script type="application/ld+json">
{
"@context": "https://schema.org",
"@type": "FAQPage",
"mainEntity": [
{
"@type": "Question",
"name": "Is AI-generated code safe? What security risks does Copilot and ChatGPT code have?",
"acceptedAnswer": {
"@type": "Answer",
"text": "AI-generated code from tools like GitHub Copilot, ChatGPT, and Cursor frequently introduces security vulnerabilities including SQL injection, hardcoded secrets, command injection, and insecure cryptography. Studies show up to 40% of AI-generated code contains security flaws. mycop is built specifically to catch these issues with 100 rules covering OWASP Top 10 and CWE Top 25 categories."
}
},
{
"@type": "Question",
"name": "How do I scan Python or JavaScript code for security vulnerabilities for free?",
"acceptedAnswer": {
"@type": "Answer",
"text": "mycop is a free, open-source security scanner that detects vulnerabilities in Python, JavaScript, and TypeScript. Install it with a single command (curl -fsSL https://raw.githubusercontent.com/AbdumajidRashidov/mycop/main/install.sh | sh), then run 'mycop scan .' in your project directory. It finds SQL injection, XSS, hardcoded secrets, and 20+ more vulnerability categories with zero configuration required."
}
},
{
"@type": "Question",
"name": "How does mycop compare to Semgrep, Bandit, and ESLint for security scanning?",
"acceptedAnswer": {
"@type": "Answer",
"text": "Unlike Semgrep (which requires custom rules) or language-specific tools like Bandit (Python only) and ESLint (JavaScript only), mycop scans Python, JavaScript, and TypeScript with a single tool and ships with 100 pre-built security rules. It also uniquely offers AI-powered auto-fix — it can automatically rewrite vulnerable code using Claude, GPT-4, or Ollama, then verify the fix by re-scanning."
}
},
{
"@type": "Question",
"name": "Can I automatically fix security vulnerabilities in my code with AI?",
"acceptedAnswer": {
"@type": "Answer",
"text": "Yes. mycop's 'mycop fix' command uses AI to automatically rewrite vulnerable code. It groups all findings per file, sends them to your chosen AI provider (Claude, GPT-4, OpenAI, or Ollama), generates a diff for you to review, and re-scans to verify the fix. Use '--dry-run' to preview changes before applying them. No AI key is needed for scanning — only for auto-fix."
}
},
{
"@type": "Question",
"name": "How do I use mycop with Claude Code, Cursor, or Windsurf for agentic security scanning?",
"acceptedAnswer": {
"@type": "Answer",
"text": "mycop includes a built-in MCP (Model Context Protocol) server. Run 'mycop mcp' to start it, then configure your agentic tool to connect. For Claude Code, add {\"mcpServers\":{\"mycop\":{\"command\":\"mycop\",\"args\":[\"mcp\"]}}} to ~/.claude/settings.json. The server exposes 5 tools (scan, list_rules, explain_finding, review, check_deps) that agents can call directly. The agent uses scan findings with fix_hint to apply fixes itself. It works with Cursor, Windsurf, Codex CLI, Gemini CLI, and any MCP-compatible client."
}
},
{
"@type": "Question",
"name": "How do I add security scanning to my CI/CD pipeline or GitHub Actions?",
"acceptedAnswer": {
"@type": "Answer",
"text": "mycop integrates directly with GitHub Actions — add 'uses: AbdumajidRashidov/mycop/action@main' to your workflow to block PRs with high-severity vulnerabilities. It outputs SARIF format for GitHub Code Scanning, works as a pre-commit hook to catch issues before they reach your repo, and supports '--diff' mode to scan only changed files. Set severity thresholds with '--fail-on' to control what blocks your pipeline."
}
}
]
}
</script>
<!-- Structured Data: HowTo -->
<script type="application/ld+json">
{
"@context": "https://schema.org",
"@type": "HowTo",
"name": "How to scan code for security vulnerabilities with mycop",
"description": "Install mycop and scan your Python, JavaScript, or TypeScript codebase for security vulnerabilities in under a minute.",
"step": [
{
"@type": "HowToStep",
"position": 1,
"name": "Install mycop",
"text": "Run: curl -fsSL https://raw.githubusercontent.com/AbdumajidRashidov/mycop/main/install.sh | sh"
},
{
"@type": "HowToStep",
"position": 2,
"name": "Scan your code",
"text": "Run: mycop scan . — This scans all Python, JavaScript, and TypeScript files in the current directory."
},
{
"@type": "HowToStep",
"position": 3,
"name": "Auto-fix vulnerabilities",
"text": "Run: mycop fix . — This uses AI to automatically fix detected vulnerabilities. Review the diffs before applying."
}
],
"tool": {
"@type": "HowToTool",
"name": "mycop CLI"
},
"totalTime": "PT2M"
}
</script>
<link rel="preconnect" href="https://fonts.googleapis.com">
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
<link
href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&family=JetBrains+Mono:wght@400;500&display=swap"
rel="stylesheet">
<style>
*,
*::before,
*::after {
box-sizing: border-box;
margin: 0;
padding: 0;
}
:root {
--bg: #ffffff;
--bg-alt: #f8f9fa;
--text: #1a1a2e;
--text-secondary: #6c757d;
--accent: #0066ff;
--accent-hover: #0052cc;
--border: #e9ecef;
--terminal-bg: #1e1e2e;
--terminal-text: #cdd6f4;
--red: #f38ba8;
--yellow: #f9e2af;
--green: #a6e3a1;
--blue: #89b4fa;
--purple: #cba6f7;
--radius: 12px;
--shadow: 0 1px 3px rgba(0, 0, 0, 0.08), 0 1px 2px rgba(0, 0, 0, 0.06);
--shadow-lg: 0 10px 25px rgba(0, 0, 0, 0.08), 0 4px 10px rgba(0, 0, 0, 0.04);
}
body {
font-family: 'Inter', -apple-system, BlinkMacSystemFont, sans-serif;
color: var(--text);
background: var(--bg);
line-height: 1.6;
-webkit-font-smoothing: antialiased;
}
code,
.mono {
font-family: 'JetBrains Mono', monospace;
}
a {
color: var(--accent);
text-decoration: none;
}
a:hover {
color: var(--accent-hover);
}
.container {
max-width: 1120px;
margin: 0 auto;
padding: 0 24px;
}
/* Nav */
nav {
position: sticky;
top: 0;
z-index: 100;
background: rgba(255, 255, 255, 0.92);
backdrop-filter: blur(12px);
border-bottom: 1px solid var(--border);
}
nav .container {
display: flex;
align-items: center;
justify-content: space-between;
height: 64px;
}
.nav-logo {
font-size: 1.25rem;
font-weight: 700;
color: var(--text);
display: flex;
align-items: center;
gap: 8px;
}
.nav-logo svg {
width: 28px;
height: 28px;
}
.nav-links {
display: flex;
align-items: center;
gap: 24px;
}
.nav-links a {
color: var(--text-secondary);
font-size: 0.9rem;
font-weight: 500;
}
.nav-links a:hover {
color: var(--text);
}
/* Buttons */
.btn {
display: inline-flex;
align-items: center;
gap: 8px;
padding: 10px 20px;
border-radius: 8px;
font-size: 0.9rem;
font-weight: 600;
border: none;
cursor: pointer;
transition: all 0.15s ease;
}
.btn-primary {
background: var(--accent);
color: #fff;
}
.btn-primary:hover {
background: var(--accent-hover);
color: #fff;
}
.btn-secondary {
background: var(--bg-alt);
color: var(--text);
border: 1px solid var(--border);
}
.btn-secondary:hover {
background: #edf0f3;
color: var(--text);
}
/* Hero */
.hero {
padding: 80px 0 60px;
text-align: center;
}
.hero-badge {
display: inline-flex;
align-items: center;
gap: 6px;
padding: 6px 14px;
background: #eef4ff;
color: var(--accent);
border-radius: 20px;
font-size: 0.8rem;
font-weight: 600;
margin-bottom: 24px;
}
.hero h1 {
font-size: clamp(2.5rem, 5vw, 3.5rem);
font-weight: 700;
line-height: 1.15;
margin-bottom: 16px;
letter-spacing: -0.02em;
}
.hero h1 span {
color: var(--accent);
}
.hero p {
font-size: 1.15rem;
color: var(--text-secondary);
max-width: 580px;
margin: 0 auto 32px;
}
.hero-actions {
display: flex;
align-items: center;
justify-content: center;
gap: 12px;
flex-wrap: wrap;
}
.install-cmd {
display: inline-flex;
align-items: center;
gap: 12px;
background: var(--terminal-bg);
color: var(--terminal-text);
padding: 12px 16px;
border-radius: 8px;
font-size: 0.85rem;
max-width: 100%;
overflow-x: auto;
}
.install-cmd code {
color: var(--green);
white-space: nowrap;
}
.install-cmd button {
background: none;
border: none;
color: var(--text-secondary);
cursor: pointer;
padding: 4px;
border-radius: 4px;
display: flex;
align-items: center;
}
.install-cmd button:hover {
color: #fff;
}
.install-cmd button.copied {
color: var(--green);
}
/* Terminal */
.terminal-section {
padding: 0 0 80px;
}
.terminal {
background: var(--terminal-bg);
border-radius: var(--radius);
overflow: hidden;
box-shadow: var(--shadow-lg);
max-width: 780px;
margin: 0 auto;
}
.terminal-bar {
display: flex;
align-items: center;
gap: 8px;
padding: 12px 16px;
background: #181825;
}
.terminal-dot {
width: 12px;
height: 12px;
border-radius: 50%;
}
.terminal-dot.r {
background: #f38ba8;
}
.terminal-dot.y {
background: #f9e2af;
}
.terminal-dot.g {
background: #a6e3a1;
}
.terminal-bar span {
flex: 1;
text-align: center;
color: var(--text-secondary);
font-size: 0.75rem;
font-family: 'JetBrains Mono', monospace;
}
.terminal-body {
padding: 20px 24px;
font-family: 'JetBrains Mono', monospace;
font-size: 0.8rem;
line-height: 1.7;
color: var(--terminal-text);
overflow-x: auto;
white-space: pre;
}
.terminal-body .prompt {
color: var(--green);
}
.terminal-body .cmd {
color: #fff;
}
.terminal-body .dim {
color: #6c7086;
}
.terminal-body .sev-critical {
color: #f38ba8;
font-weight: 700;
}
.terminal-body .sev-high {
color: #fab387;
font-weight: 700;
}
.terminal-body .sev-medium {
color: #f9e2af;
}
.terminal-body .file {
color: #89b4fa;
}
.terminal-body .rule {
color: #cba6f7;
}
.terminal-body .msg {
color: var(--terminal-text);
}
.terminal-body .fix {
color: #a6e3a1;
}
.terminal-body .summary {
color: #f9e2af;
font-weight: 500;
}
/* Features */
.features {
padding: 80px 0;
background: var(--bg-alt);
}
.section-label {
text-transform: uppercase;
font-size: 0.75rem;
font-weight: 700;
letter-spacing: 0.08em;
color: var(--accent);
margin-bottom: 8px;
}
.section-title {
font-size: 2rem;
font-weight: 700;
margin-bottom: 12px;
letter-spacing: -0.01em;
}
.section-subtitle {
color: var(--text-secondary);
font-size: 1.05rem;
margin-bottom: 48px;
max-width: 520px;
}
.features-grid {
display: grid;
grid-template-columns: repeat(3, 1fr);
gap: 20px;
}
.feature-card {
background: #fff;
border: 1px solid var(--border);
border-radius: var(--radius);
padding: 28px 24px;
transition: box-shadow 0.2s;
}
.feature-card:hover {
box-shadow: var(--shadow-lg);
}
.feature-icon {
width: 44px;
height: 44px;
background: #eef4ff;
border-radius: 10px;
display: flex;
align-items: center;
justify-content: center;
margin-bottom: 16px;
font-size: 1.25rem;
}
.feature-card h3 {
font-size: 1rem;
font-weight: 600;
margin-bottom: 8px;
}
.feature-card p {
color: var(--text-secondary);
font-size: 0.88rem;
line-height: 1.5;
}
/* Languages */
.languages {
padding: 80px 0;
}
.lang-grid {
display: flex;
justify-content: center;
gap: 40px;
flex-wrap: wrap;
}
.lang-card {
display: flex;
flex-direction: column;
align-items: center;
gap: 12px;
padding: 32px 48px;
border: 1px solid var(--border);
border-radius: var(--radius);
transition: box-shadow 0.2s;
}
.lang-card:hover {
box-shadow: var(--shadow-lg);
}
.lang-card svg {
width: 48px;
height: 48px;
}
.lang-card span {
font-weight: 600;
font-size: 0.95rem;
}
/* Install */
.install {
padding: 80px 0;
background: var(--bg-alt);
}
.install-tabs {
display: flex;
gap: 4px;
margin-bottom: 20px;
background: #fff;
border: 1px solid var(--border);
border-radius: 8px;
padding: 4px;
width: fit-content;
}
.install-tab {
padding: 8px 18px;
border: none;
background: none;
font-family: inherit;
font-size: 0.85rem;
font-weight: 500;
color: var(--text-secondary);
cursor: pointer;
border-radius: 6px;
transition: all 0.15s;
}
.install-tab.active {
background: var(--accent);
color: #fff;
}
.install-panel {
display: none;
background: var(--terminal-bg);
border-radius: var(--radius);
padding: 20px 24px;
max-width: 100%;
overflow-x: auto;
}
.install-panel.active {
display: block;
}
.install-panel code {
color: var(--green);
font-size: 0.85rem;
line-height: 1.8;
white-space: pre-wrap;
word-break: break-all;
}
.install-panel .dim {
color: #6c7086;
}
/* Integrations */
.integrations {
padding: 80px 0;
}
.integrations-grid {
display: grid;
grid-template-columns: repeat(2, 1fr);
gap: 20px;
}
.integration-card {
border: 1px solid var(--border);
border-radius: var(--radius);
overflow: hidden;
}
.integration-header {
padding: 20px 24px;
border-bottom: 1px solid var(--border);
}
.integration-header h3 {
font-size: 1rem;
font-weight: 600;
margin-bottom: 4px;
}
.integration-header p {
color: var(--text-secondary);
font-size: 0.82rem;
}
.integration-code {
background: var(--terminal-bg);
padding: 16px 20px;
font-family: 'JetBrains Mono', monospace;
font-size: 0.75rem;
line-height: 1.7;
color: var(--terminal-text);
overflow-x: auto;
white-space: pre;
}
.integration-code .key {
color: #89b4fa;
}
.integration-code .str {
color: #a6e3a1;
}
.integration-code .comment {
color: #6c7086;
}
/* Rules */
.rules {
padding: 80px 0;
background: var(--bg-alt);
}
.rules-table {
width: 100%;
border-collapse: collapse;
background: #fff;
border-radius: var(--radius);
overflow: hidden;
border: 1px solid var(--border);
font-size: 0.88rem;
}
.rules-table th {
background: var(--bg-alt);
text-align: left;
padding: 12px 16px;
font-weight: 600;
font-size: 0.8rem;
text-transform: uppercase;
letter-spacing: 0.04em;
color: var(--text-secondary);
border-bottom: 1px solid var(--border);
}
.rules-table td {
padding: 10px 16px;
border-bottom: 1px solid var(--border);
}
.rules-table tr:last-child td {
border-bottom: none;
}
.rules-table .rule-id {
font-family: 'JetBrains Mono', monospace;
font-size: 0.8rem;
color: var(--accent);
}
.rules-table .na {
color: var(--text-secondary);
}
/* Blog */
.blog {
padding: 80px 0;
}
.blog-grid {
display: grid;
grid-template-columns: repeat(auto-fill, minmax(320px, 1fr));
gap: 20px;
}
.blog-card {
border: 1px solid var(--border);
border-radius: var(--radius);
overflow: hidden;
transition: box-shadow 0.2s, transform 0.2s;
text-decoration: none;
color: inherit;
display: flex;
flex-direction: column;
}
.blog-card:hover {
box-shadow: var(--shadow-lg);
transform: translateY(-2px);
color: inherit;
}
.blog-card-body {
padding: 24px;
flex: 1;
display: flex;
flex-direction: column;
}
.blog-card-tags {
display: flex;
gap: 6px;
margin-bottom: 12px;
}
.blog-card-tags span {
padding: 3px 10px;
background: #eef4ff;
color: var(--accent);
border-radius: 20px;
font-size: 0.7rem;
font-weight: 600;
}
.blog-card h3 {
font-size: 1.1rem;
font-weight: 700;
margin-bottom: 8px;
line-height: 1.4;
}
.blog-card p {
color: var(--text-secondary);
font-size: 0.88rem;
line-height: 1.6;
flex: 1;
}
.blog-card-footer {
padding: 16px 24px;
border-top: 1px solid var(--border);
font-size: 0.8rem;
color: var(--text-secondary);
display: flex;
align-items: center;
justify-content: space-between;
}
.blog-card-footer .read-more {
color: var(--accent);
font-weight: 600;
}
/* FAQ */
.faq {
padding: 80px 0;
}
.faq-list {
max-width: 720px;
margin: 0 auto;
}
.faq-list details {
border: 1px solid var(--border);
border-radius: var(--radius);
margin-bottom: 12px;
transition: box-shadow 0.2s;
}
.faq-list details:hover {
box-shadow: var(--shadow);
}
.faq-list details[open] {
box-shadow: var(--shadow-lg);
}
.faq-list summary {
padding: 18px 24px;
font-weight: 600;
font-size: 0.95rem;
cursor: pointer;
list-style: none;
display: flex;
align-items: center;
justify-content: space-between;
gap: 12px;
}
.faq-list summary::-webkit-details-marker {
display: none;
}
.faq-list summary::after {
content: '+';
font-size: 1.25rem;
color: var(--text-secondary);
flex-shrink: 0;
}
.faq-list details[open] summary::after {
content: '\2212';
}
.faq-list .faq-answer {
padding: 0 24px 18px;
color: var(--text-secondary);
font-size: 0.9rem;
line-height: 1.7;
}
/* Footer */
footer {
padding: 40px 0;
border-top: 1px solid var(--border);
color: var(--text-secondary);
font-size: 0.85rem;
}
footer .container {
display: flex;
align-items: center;
justify-content: space-between;
flex-wrap: wrap;
gap: 12px;
}
footer a {
color: var(--text-secondary);
}
footer a:hover {
color: var(--text);
}
.footer-links {
display: flex;
gap: 20px;
}
/* Responsive */
@media (max-width: 768px) {
.hero {
padding: 48px 0 40px;
}
.features-grid,
.integrations-grid {
grid-template-columns: 1fr;
}
.lang-grid {
gap: 16px;
}
.lang-card {
padding: 24px 36px;
}
.nav-links .hide-mobile {
display: none;
}
.rules-table {
font-size: 0.8rem;
}
.rules-table th,
.rules-table td {
padding: 8px 10px;
}
.hero-actions {
flex-direction: column;
}
}
@media (max-width: 480px) {
.install-tabs {
flex-wrap: wrap;
}
}
</style>
</head>
<body>
<!-- Nav -->
<nav>
<div class="container">
<a href="./" class="nav-logo">
<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round"
stroke-linejoin="round">
<path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z" />
</svg>
mycop
</a>
<div class="nav-links">
<a href="#features" class="hide-mobile">Features</a>
<a href="#install" class="hide-mobile">Install</a>
<a href="#integrations" class="hide-mobile">Integrations</a>
<a href="#blog" class="hide-mobile">Blog</a>
<a href="https://github.com/AbdumajidRashidov/mycop" target="_blank" class="btn btn-secondary" style="gap:6px;border:none">
<svg width="16" height="16" viewBox="0 0 16 16" fill="currentColor">
<path
d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z" />
</svg>
GitHub
<svg width="16" height="16" viewBox="0 0 16 16" fill="#f5c211" stroke="#f5c211">
<polygon points="8,0.5 10.1,5.3 15.5,5.8 11.4,9.4 12.6,14.8 8,12 3.4,14.8 4.6,9.4 0.5,5.8 5.9,5.3" />
</svg>
<span id="star-count" style="font-weight:600;color:var(--text)">Star</span>
<span style="width:1px;height:16px;background:var(--border)"></span>
</a>
</div>
</div>
</nav>
<main>
<!-- Hero -->
<section class="hero">
<div class="container">
<div class="hero-badge">
<svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5">
<path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z" />
</svg>
Open-source security scanner
</div>
<div style="display:flex;align-items:center;justify-content:center;gap:8px;margin-bottom:20px">
<a href="https://crates.io/crates/mycop" target="_blank"><img src="https://img.shields.io/crates/v/mycop.svg" alt="Crates.io"></a>
<a href="https://github.com/AbdumajidRashidov/mycop/actions/workflows/ci.yml" target="_blank"><img src="https://github.com/AbdumajidRashidov/mycop/actions/workflows/ci.yml/badge.svg" alt="CI"></a>
<a href="https://github.com/AbdumajidRashidov/mycop/blob/main/LICENSE" target="_blank"><img src="https://img.shields.io/badge/License-MIT-blue.svg" alt="MIT License"></a>
</div>
<h1>Catch vulnerabilities in<br><span>AI-generated code</span></h1>
<p>mycop scans Python, JavaScript, and TypeScript for security issues that AI coding assistants commonly
introduce. 100 built-in rules, AI-powered auto-fix, zero config.</p>
<div class="hero-actions">
<div class="install-cmd">
<span class="dim">$</span>
<code>curl -fsSL https://raw.githubusercontent.com/AbdumajidRashidov/mycop/main/install.sh | sh</code>
<button onclick="copyInstall(this)" title="Copy">
<svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
<rect x="9" y="9" width="13" height="13" rx="2" />
<path d="M5 15H4a2 2 0 01-2-2V4a2 2 0 012-2h9a2 2 0 012 2v1" />
</svg>
</button>
</div>
<a href="https://github.com/AbdumajidRashidov/mycop" target="_blank" class="btn btn-primary">
View on GitHub
<svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
<path d="M5 12h14M12 5l7 7-7 7" />
</svg>
</a>
</div>
</div>
</section>
<!-- Terminal Demo -->
<section class="terminal-section">
<div class="container">
<div class="terminal">
<div class="terminal-bar">
<div class="terminal-dot r"></div>
<div class="terminal-dot y"></div>
<div class="terminal-dot g"></div>
<span>mycop</span>
<div style="width:36px"></div>
</div>
<div class="terminal-body"><span class="prompt">$</span> <span class="cmd">mycop scan src/</span>
<span class="dim">Scanning 12 files...</span>
<span class="sev-critical">CRITICAL</span> <span class="file">src/auth.py:24</span> <span
class="rule">PY-SEC-001</span>
<span class="msg">SQL injection via string formatting in query</span>
<span class="dim">query = f"SELECT * FROM users WHERE id = {user_id}"</span>
<span class="sev-high">HIGH</span> <span class="file">src/utils.js:8</span> <span
class="rule">JS-SEC-002</span>
<span class="msg">Dangerous eval() call with user-controlled input</span>
<span class="dim">const result = eval(req.body.expression)</span>
<span class="sev-medium">MEDIUM</span> <span class="file">src/config.py:15</span> <span
class="rule">PY-SEC-003</span>
<span class="msg">Hardcoded secret detected in source code</span>
<span class="dim">API_KEY = "sk-live-a1b2c3d4e5f6"</span>
<span class="summary">Found 3 findings (1 critical, 1 high, 1 medium)</span>
<span class="prompt">$</span> <span class="cmd">mycop fix src/ --dry-run</span>
<span class="fix"> Fixed src/auth.py — parameterized query</span>
<span class="fix"> Fixed src/utils.js — replaced eval with safe parser</span>
<span class="fix"> Fixed src/config.py — moved secret to environment variable</span>
</div>
</div>
</div>
</section>
<!-- Features -->
<section class="features" id="features">
<div class="container">
<div class="section-label">Features</div>
<h2 class="section-title">Security scanning, built for modern dev workflows</h2>
<p class="section-subtitle">Everything you need to keep AI-generated code safe, from detection to automated
remediation.</p>
<div class="features-grid">
<div class="feature-card">
<div class="feature-icon">
<svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="var(--accent)" stroke-width="2">
<path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z" />
</svg>
</div>
<h3>100 Built-in Rules</h3>
<p>Covers OWASP Top 10 and CWE Top 25 including SQL injection, XSS, command injection, cryptography flaws, auth
issues, and more. All mapped to CWE identifiers.</p>
</div>
<div class="feature-card">
<div class="feature-icon">
<svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="var(--accent)" stroke-width="2">
<path d="M12 20h9" />
<path d="M16.5 3.5a2.12 2.12 0 013 3L7 19l-4 1 1-4L16.5 3.5z" />
</svg>
</div>
<h3>AI-Powered Auto-Fix</h3>
<p>Automatically rewrites vulnerable code using Claude, GPT-4, Ollama, or any supported provider. Review diffs
before applying.</p>
</div>
<div class="feature-card">
<div class="feature-icon">
<svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="var(--accent)" stroke-width="2">
<path d="M21 15a2 2 0 01-2 2H7l-4 4V5a2 2 0 012-2h14a2 2 0 012 2z" />
</svg>
</div>
<h3>Inline Ignore</h3>
<p>Suppress specific findings with <code class="mono"
style="font-size:0.82rem;background:#eef4ff;padding:2px 6px;border-radius:4px"># mycop-ignore:RULE-ID</code>
comments. Supports all rules or specific IDs.</p>
</div>
<div class="feature-card">
<div class="feature-icon">
<svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="var(--accent)" stroke-width="2">
<rect x="2" y="3" width="20" height="14" rx="2" />
<path d="M8 21h8M12 17v4" />
</svg>
</div>
<h3>Multiple Output Formats</h3>
<p>Terminal output with colored context, JSON for scripting, and SARIF for IDE and CI integration like GitHub
Code Scanning.</p>
</div>
<div class="feature-card">
<div class="feature-icon">
<svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="var(--accent)" stroke-width="2">
<circle cx="12" cy="12" r="3" />
<path
d="M12 1v2M12 21v2M4.22 4.22l1.42 1.42M18.36 18.36l1.42 1.42M1 12h2M21 12h2M4.22 19.78l1.42-1.42M18.36 5.64l1.42-1.42" />
</svg>
</div>
<h3>5 AI Providers</h3>
<p>Auto-detects Claude CLI, Anthropic API, OpenAI, Ollama, or falls back to rule-based hints. No AI required
for scanning.</p>
</div>
<div class="feature-card">
<div class="feature-icon">
<svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="var(--accent)" stroke-width="2">
<path d="M10.29 3.86L1.82 18a2 2 0 001.71 3h16.94a2 2 0 001.71-3L13.71 3.86a2 2 0 00-3.42 0z" />
<path d="M12 9v4M12 17h.01" />
</svg>
</div>
<h3>Configurable Thresholds</h3>
<p>Set minimum severity to report and separate fail threshold for CI gates via CLI flags or <code class="mono"
style="font-size:0.82rem;background:#eef4ff;padding:2px 6px;border-radius:4px">.scanrc.yml</code> config.
</p>
</div>
</div>
</div>
</section>
<!-- Languages -->
<section class="languages" id="languages">
<div class="container" style="text-align:center">
<div class="section-label">Language Support</div>
<h2 class="section-title">Scan the languages you ship</h2>
<p class="section-subtitle" style="margin:0 auto 48px">Pattern matching and AST-level analysis for the most common
AI-assisted languages.</p>
<div class="lang-grid">
<div class="lang-card">
<svg viewBox="0 0 128 128">
<linearGradient id="py-a" x1="70.252" x2="170.659" y1="1237.476" y2="1151.089"
gradientTransform="matrix(.563 0 0 -.568 -29.215 707.817)" gradientUnits="userSpaceOnUse">
<stop offset="0" stop-color="#5A9FD4" />
<stop offset="1" stop-color="#306998" />
</linearGradient>
<linearGradient id="py-b" x1="209.474" x2="173.62" y1="1098.811" y2="1149.537"
gradientTransform="matrix(.563 0 0 -.568 -29.215 707.817)" gradientUnits="userSpaceOnUse">
<stop offset="0" stop-color="#FFD43B" />
<stop offset="1" stop-color="#FFE873" />
</linearGradient>
<path fill="url(#py-a)"
d="M63.391 1.988c-4.222.02-8.252.379-11.8 1.007-10.45 1.846-12.346 5.71-12.346 12.837v9.411h24.693v3.137H29.977c-7.176 0-13.46 4.313-15.426 12.521-2.268 9.405-2.368 15.275 0 25.096 1.755 7.311 5.947 12.519 13.124 12.519h8.491V67.234c0-8.151 7.051-15.34 15.426-15.34h24.665c6.866 0 12.346-5.654 12.346-12.548V15.833c0-6.693-5.646-11.72-12.346-12.837-4.244-.706-8.645-1.027-12.866-1.008zM50.037 9.557c2.55 0 4.634 2.117 4.634 4.721 0 2.593-2.083 4.69-4.634 4.69-2.56 0-4.633-2.097-4.633-4.69-.001-2.604 2.073-4.721 4.633-4.721z" />
<path fill="url(#py-b)"
d="M91.682 28.38v10.966c0 8.5-7.208 15.655-15.426 15.655H51.591c-6.756 0-12.346 5.783-12.346 12.549v23.515c0 6.691 5.818 10.628 12.346 12.547 7.816 2.297 15.312 2.713 24.665 0 6.216-1.801 12.346-5.423 12.346-12.547v-9.412H63.938v-3.138h37.012c7.176 0 9.852-5.005 12.348-12.519 2.578-7.735 2.467-15.174 0-25.096-1.774-7.145-5.161-12.521-12.348-12.521h-9.268zM77.809 87.927c2.561 0 4.634 2.097 4.634 4.692 0 2.602-2.074 4.719-4.634 4.719-2.55 0-4.633-2.117-4.633-4.719 0-2.595 2.083-4.692 4.633-4.692z" />
</svg>
<span>Python</span>
</div>
<div class="lang-card">
<svg viewBox="0 0 128 128">
<path fill="#F0DB4F" d="M1.408 1.408h125.184v125.185H1.408z" />
<path fill="#323330"
d="M116.347 96.736c-.917-5.711-4.641-10.508-15.672-14.981-3.832-1.761-8.104-3.022-9.377-5.926-.452-1.69-.512-2.642-.226-3.665.821-3.32 4.784-4.355 7.925-3.403 2.023.678 3.938 2.237 5.093 4.724 5.402-3.498 5.391-3.475 9.163-5.879-1.381-2.141-2.118-3.129-3.022-4.045-3.249-3.629-7.676-5.498-14.756-5.355l-3.688.477c-3.534.893-6.902 2.748-8.877 5.235-5.926 6.724-4.236 18.492 2.975 23.335 7.104 5.332 17.54 6.545 18.873 11.531 1.297 6.104-4.486 8.08-10.234 7.378-4.236-.881-6.592-3.034-9.139-6.949-4.688 2.713-4.688 2.713-9.508 5.485 1.143 2.499 2.344 3.63 4.26 5.795 9.068 9.198 31.76 8.746 35.83-5.176.165-.478 1.261-3.666.38-8.581zM69.462 58.943H57.753l-.048 30.272c0 6.438.333 12.34-.714 14.149-1.713 3.558-6.152 3.117-8.175 2.427-2.059-1.012-3.106-2.451-4.319-4.485-.333-.584-.583-1.036-.667-1.071l-9.52 5.83c1.583 3.249 3.915 6.069 6.902 7.901 4.462 2.678 10.459 3.499 16.731 2.059 4.082-1.189 7.604-3.652 9.448-7.401 2.666-4.915 2.094-10.864 2.07-17.444.06-10.735.001-21.468.001-32.237z" />
</svg>
<span>JavaScript</span>
</div>
<div class="lang-card">
<svg viewBox="0 0 128 128">
<rect fill="#007acc" width="128" height="128" rx="6" />
<text x="64" y="84" text-anchor="middle" fill="#fff" font-family="Arial, Helvetica, sans-serif"
font-weight="bold" font-size="64">TS</text>
</svg>
<span>TypeScript</span>
</div>
</div>
</div>
</section>
<!-- Install -->
<section class="install" id="install">
<div class="container">
<div class="section-label">Installation</div>
<h2 class="section-title">Get started in seconds</h2>
<p class="section-subtitle">Choose your preferred installation method.</p>
<div class="install-tabs">
<button class="install-tab active" onclick="switchTab(this, 'tab-script')">Install Script</button>
<button class="install-tab" onclick="switchTab(this, 'tab-brew')">Homebrew</button>
<button class="install-tab" onclick="switchTab(this, 'tab-cargo')">Cargo</button>
<button class="install-tab" onclick="switchTab(this, 'tab-docker')">Docker</button>
</div>
<div class="install-panel active" id="tab-script"><code><span class="dim"># macOS & Linux</span>
curl -fsSL https://raw.githubusercontent.com/AbdumajidRashidov/mycop/main/install.sh | sh
<span class="dim"># Verify installation</span>
mycop --version</code></div>
<div class="install-panel" id="tab-brew"><code>brew install AbdumajidRashidov/tap/mycop</code></div>
<div class="install-panel" id="tab-cargo"><code>cargo install mycop</code></div>
<div class="install-panel" id="tab-docker"><code>docker run --rm -v "$(pwd):/src" -w /src ghcr.io/abdumajidrashidov/mycop scan .</code>
</div>
</div>
</section>
<!-- Integrations -->
<section class="integrations" id="integrations">
<div class="container">
<div class="section-label">Integrations</div>
<h2 class="section-title">Fits into your existing workflow</h2>
<p class="section-subtitle">Use mycop in CI, as a git hook, or directly in your editor.</p>
<div class="integrations-grid">
<div class="integration-card">
<div class="integration-header">
<h3>GitHub Action</h3>
<p>Add security scanning to your CI pipeline</p>
</div>
<div class="integration-code"><span class="key">- name</span>: <span class="str">mycop Security Scan</span>
<span class="key">uses</span>: <span class="str">AbdumajidRashidov/mycop/action@main</span>
<span class="key">with</span>:
<span class="key">paths</span>: <span class="str">'.'</span>
<span class="key">fail-on</span>: <span class="str">'high'</span>
<span class="key">format</span>: <span class="str">'sarif'</span>
</div>
</div>
<div class="integration-card">
<div class="integration-header">
<h3>Pre-commit Hook</h3>
<p>Catch issues before they reach the repo</p>
</div>
<div class="integration-code"><span class="comment"># .pre-commit-config.yaml</span>
<span class="key">repos</span>:
- <span class="key">repo</span>: <span class="str">https://github.com/AbdumajidRashidov/mycop</span>
<span class="key">rev</span>: <span class="str">main</span>
<span class="key">hooks</span>:
- <span class="key">id</span>: <span class="str">mycop</span>
</div>
</div>
<div class="integration-card">
<div class="integration-header">
<h3>MCP Server <span
style="font-size:0.7rem;font-weight:500;color:#fff;background:var(--accent);padding:2px 8px;border-radius:4px;margin-left:6px">New</span></h3>
<p>Agentic security scanning in Claude Code, Cursor, Windsurf</p>
</div>
<div class="integration-code"><span class="comment">// Claude Code (~/.claude/settings.json)</span>
{
<span class="key">"mcpServers"</span>: {
<span class="key">"mycop"</span>: {
<span class="key">"command"</span>: <span class="str">"mycop"</span>,
<span class="key">"args"</span>: [<span class="str">"mcp"</span>]
}
}
}
<span class="comment">// 5 tools: scan, review, explain & more</span>
</div>
</div>
<div class="integration-card">
<div class="integration-header">
<h3>VS Code Extension <span
style="font-size:0.7rem;font-weight:500;color:var(--accent);background:#eef4ff;padding:2px 8px;border-radius:4px;margin-left:6px">Coming
Soon</span></h3>
<p>Real-time security diagnostics in your editor</p>
</div>
<div class="integration-code"><span class="comment">// Scan on save</span>
<span class="comment">// Diagnostics in Problems panel</span>
<span class="comment">// Commands:</span>
<span class="str"> "mycop: Scan Current File"</span>
<span class="str"> "mycop: Scan Workspace"</span>
<span class="comment">// Configure in settings.json:</span>
<span class="str"> "mycop.severity": "medium"</span>
<span class="str"> "mycop.scanOnSave": true</span>
</div>
</div>
</div>
</div>
</section>
<!-- Rules -->
<section class="rules" id="rules">
<div class="container">
<div class="section-label">Security Rules</div>
<h2 class="section-title">100 rules covering OWASP Top 10 & CWE Top 25</h2>
<p class="section-subtitle">50 Python + 50 JavaScript rules, each mapped to CWE identifiers for standards compliance.</p>
<table class="rules-table">
<thead>
<tr>
<th>Category</th>
<th>Python</th>
<th>JavaScript</th>
</tr>
</thead>
<tbody>
<tr>
<td>SQL Injection (CWE-89)</td>
<td class="rule-id">PY-SEC-001, 042</td>
<td class="rule-id">JS-SEC-011</td>
</tr>
<tr>
<td>Command Injection (CWE-78)</td>
<td class="rule-id">PY-SEC-002, 045, 050</td>
<td class="rule-id">JS-SEC-016</td>
</tr>
<tr>
<td>Hardcoded Secrets (CWE-798)</td>
<td class="rule-id">PY-SEC-003, 034, 043</td>
<td class="rule-id">JS-SEC-004, 034</td>
</tr>
<tr>
<td>Insecure Random (CWE-330)</td>
<td class="rule-id">PY-SEC-004</td>
<td class="rule-id">JS-SEC-005</td>
</tr>
<tr>
<td>Eval/Exec Injection (CWE-95)</td>
<td class="rule-id">PY-SEC-005</td>
<td class="rule-id">JS-SEC-002, 049</td>
</tr>
<tr>
<td>Path Traversal / Zip Slip (CWE-22)</td>
<td class="rule-id">PY-SEC-006, 037</td>
<td class="rule-id">JS-SEC-006, 037</td>
</tr>
<tr>
<td>Insecure Deserialization (CWE-502)</td>
<td class="rule-id">PY-SEC-007</td>
<td class="rule-id">JS-SEC-009</td>
</tr>
<tr>
<td>XSS (CWE-79)</td>
<td class="rule-id">PY-SEC-009, 044</td>
<td class="rule-id">JS-SEC-001, 010, 041</td>
</tr>
<tr>
<td>SSRF (CWE-918)</td>
<td class="rule-id">PY-SEC-011</td>
<td class="rule-id">JS-SEC-007</td>
</tr>
<tr>
<td>XXE (CWE-611)</td>
<td class="rule-id">PY-SEC-012</td>
<td class="rule-id">JS-SEC-012</td>
</tr>
<tr>
<td>Template Injection (CWE-1336)</td>
<td class="rule-id">PY-SEC-014</td>
<td class="rule-id">JS-SEC-013</td>
</tr>
<tr>
<td>Weak Crypto (CWE-327/328)</td>
<td class="rule-id">PY-SEC-017–021</td>
<td class="rule-id">JS-SEC-017–022</td>
</tr>
<tr>
<td>Insecure TLS (CWE-295)</td>
<td class="rule-id">PY-SEC-022</td>
<td class="rule-id">JS-SEC-021</td>
</tr>
<tr>
<td>JWT None Alg (CWE-345)</td>
<td class="rule-id">PY-SEC-023</td>
<td class="rule-id">JS-SEC-023</td>
</tr>
<tr>
<td>Open Redirect (CWE-601)</td>
<td class="rule-id">PY-SEC-027</td>
<td class="rule-id">JS-SEC-027</td>
</tr>
<tr>
<td>CORS Misconfiguration (CWE-942)</td>
<td class="rule-id">PY-SEC-028</td>
<td class="rule-id">JS-SEC-028</td>
</tr>
<tr>
<td>Mass Assignment (CWE-915)</td>
<td class="rule-id">PY-SEC-029</td>
<td class="rule-id">JS-SEC-030</td>
</tr>
<tr>
<td>Debug Mode (CWE-215)</td>
<td class="rule-id">PY-SEC-031</td>
<td class="rule-id">JS-SEC-031</td>
</tr>
<tr>
<td>Timing Attack (CWE-208)</td>
<td class="rule-id">PY-SEC-046</td>
<td class="rule-id">JS-SEC-046</td>
</tr>
<tr>
<td>ReDoS (CWE-1333)</td>
<td class="rule-id">PY-SEC-047</td>
<td class="rule-id">JS-SEC-047</td>
</tr>
<tr>
<td colspan="3" style="text-align:center;color:var(--muted);font-size:0.85rem;padding:12px">
… and 20+ more categories. Run <code style="background:#eef4ff;padding:2px 6px;border-radius:4px;font-size:0.82rem">mycop rules list</code> for the full list.
</td>
</tr>
</tbody>
</table>
</div>
</section>
<!-- Blog -->
<section class="blog" id="blog">
<div class="container">
<div class="section-label">Blog</div>
<h2 class="section-title">Latest from the blog</h2>
<p class="section-subtitle">Deep dives into AI code security, vulnerability patterns, and how to defend against them.</p>
<div class="blog-grid">
<a href="blog/mycop-mcp-server.html" class="blog-card">
<div class="blog-card-body">
<div class="blog-card-tags">
<span>MCP</span>
<span>Agentic</span>
<span>Integration</span>
</div>
<h3>mycop Now Speaks MCP: Security Scanning Inside Your AI Coding Assistant</h3>
<p>mycop 0.3.0 ships with a built-in MCP server. Claude Code, Cursor, Windsurf, and other agentic tools can now scan, fix, and review code for vulnerabilities without leaving the conversation.</p>
</div>
<div class="blog-card-footer">
<span>February 15, 2026</span>
<span class="read-more">Read article →</span>
</div>
</a>
<a href="blog/security-bugs-ai-coding-assistants.html" class="blog-card">
<div class="blog-card-body">
<div class="blog-card-tags">
<span>Security</span>
<span>Python</span>
<span>JavaScript</span>
<span>AI</span>
</div>
<h3>The Security Bugs AI Coding Assistants Keep Writing</h3>
<p>I analyzed the patterns of security vulnerabilities that AI coding assistants repeatedly introduce — SQL injection, eval(), hardcoded secrets, and more. Real code examples and how to catch them.</p>
</div>
<div class="blog-card-footer">
<span>February 15, 2026</span>
<span class="read-more">Read article →</span>
</div>
</a>
</div>
</div>
</section>
<!-- FAQ -->
<section class="faq" id="faq">
<div class="container">
<div class="section-label">FAQ</div>
<h2 class="section-title">Frequently asked questions</h2>
<p class="section-subtitle">What developers ask before adopting a security scanner.</p>
<div class="faq-list">
<details>
<summary>Is AI-generated code safe? What security risks does Copilot and ChatGPT code have?</summary>
<div class="faq-answer">AI-generated code from tools like GitHub Copilot, ChatGPT, and Cursor frequently introduces security vulnerabilities — including SQL injection, hardcoded secrets, command injection, and insecure cryptography. Studies show up to 40% of AI-generated code contains security flaws. mycop is built specifically to catch these issues with 100 rules covering OWASP Top 10 and CWE Top 25 categories.</div>
</details>
<details>
<summary>How do I scan Python or JavaScript code for security vulnerabilities for free?</summary>
<div class="faq-answer">mycop is a free, open-source security scanner that detects vulnerabilities in Python, JavaScript, and TypeScript. Install it with a single command (<code class="mono" style="font-size:0.82rem;background:#eef4ff;padding:2px 6px;border-radius:4px">curl -fsSL https://raw.githubusercontent.com/AbdumajidRashidov/mycop/main/install.sh | sh</code>), then run <code class="mono" style="font-size:0.82rem;background:#eef4ff;padding:2px 6px;border-radius:4px">mycop scan .</code> in your project directory. It finds SQL injection, XSS, hardcoded secrets, and 20+ more vulnerability categories with zero configuration required.</div>
</details>
<details>
<summary>How does mycop compare to Semgrep, Bandit, and ESLint for security scanning?</summary>
<div class="faq-answer">Unlike Semgrep (which requires custom rules) or language-specific tools like Bandit (Python only) and ESLint (JavaScript only), mycop scans Python, JavaScript, and TypeScript with a single tool and ships with 100 pre-built security rules. It also uniquely offers AI-powered auto-fix — it can automatically rewrite vulnerable code using Claude, GPT-4, or Ollama, then verify the fix by re-scanning.</div>
</details>
<details>
<summary>Can I automatically fix security vulnerabilities in my code with AI?</summary>
<div class="faq-answer">Yes. The <code class="mono" style="font-size:0.82rem;background:#eef4ff;padding:2px 6px;border-radius:4px">mycop fix</code> command uses AI to automatically rewrite vulnerable code. It groups all findings per file, sends them to your chosen AI provider (Claude, GPT-4, OpenAI, or Ollama), generates a diff for you to review, and re-scans to verify the fix. Use <code class="mono" style="font-size:0.82rem;background:#eef4ff;padding:2px 6px;border-radius:4px">--dry-run</code> to preview changes before applying. No AI key is needed for scanning — only for auto-fix.</div>
</details>
<details>
<summary>How do I use mycop with Claude Code, Cursor, or Windsurf?</summary>
<div class="faq-answer">mycop includes a built-in MCP (Model Context Protocol) server that lets agentic coding tools call its scanning, fixing, and review capabilities directly. Run <code class="mono" style="font-size:0.82rem;background:#eef4ff;padding:2px 6px;border-radius:4px">mycop mcp</code> to start the server, then configure your tool to connect. For Claude Code, add <code class="mono" style="font-size:0.82rem;background:#eef4ff;padding:2px 6px;border-radius:4px">{"mcpServers":{"mycop":{"command":"mycop","args":["mcp"]}}}</code> to your settings. It works with Cursor, Windsurf, Codex CLI, Gemini CLI, and any MCP-compatible client.</div>
</details>
<details>
<summary>How do I add security scanning to my CI/CD pipeline or GitHub Actions?</summary>
<div class="faq-answer">mycop integrates directly with GitHub Actions — add <code class="mono" style="font-size:0.82rem;background:#eef4ff;padding:2px 6px;border-radius:4px">uses: AbdumajidRashidov/mycop/action@main</code> to your workflow to block PRs with high-severity vulnerabilities. It outputs SARIF format for GitHub Code Scanning, works as a pre-commit hook to catch issues before they reach your repo, and supports <code class="mono" style="font-size:0.82rem;background:#eef4ff;padding:2px 6px;border-radius:4px">--diff</code> mode to scan only changed files.</div>
</details>
</div>
</div>
</section>
</main>
<!-- Footer -->
<footer>
<div class="container">
<span>MIT License · Built with Rust</span>
<div class="footer-links">
<a href="https://github.com/AbdumajidRashidov/mycop" target="_blank">GitHub</a>
<a href="https://crates.io/crates/mycop" target="_blank">Crates.io</a>
<a href="https://github.com/AbdumajidRashidov/homebrew-tap/blob/main/Formula/mycop.rb" target="_blank">Homebrew</a>
<a href="https://github.com/AbdumajidRashidov/mycop/issues" target="_blank">Issues</a>
<a href="https://github.com/AbdumajidRashidov/mycop/blob/main/CHANGELOG.md" target="_blank">Changelog</a>
</div>
</div>
</footer>
<script>
function copyInstall(btn) {
const text = 'curl -fsSL https://raw.githubusercontent.com/AbdumajidRashidov/mycop/main/install.sh | sh';
navigator.clipboard.writeText(text).then(() => {
btn.classList.add('copied');
btn.innerHTML = '<svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M20 6L9 17l-5-5"/></svg>';
setTimeout(() => {
btn.classList.remove('copied');
btn.innerHTML = '<svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><rect x="9" y="9" width="13" height="13" rx="2"/><path d="M5 15H4a2 2 0 01-2-2V4a2 2 0 012-2h9a2 2 0 012 2v1"/></svg>';
}, 2000);
});
}
function switchTab(tab, panelId) {
document.querySelectorAll('.install-tab').forEach(t => t.classList.remove('active'));
document.querySelectorAll('.install-panel').forEach(p => p.classList.remove('active'));
tab.classList.add('active');
document.getElementById(panelId).classList.add('active');
}
fetch('https://api.github.com/repos/AbdumajidRashidov/mycop')
.then(r => r.json())
.then(d => {
if (d.stargazers_count !== undefined) {
document.getElementById('star-count').textContent = d.stargazers_count;
}
})
.catch(() => { });
</script>
</body>
</html>
