medusa

Why we included this project

Anyone shipping code that touches LLM agents, MCP servers, or AI-assisted workflows is trusting a growing pile of third-party components, and that trust carries a class of risk older scanners were never built to catch: poisoned repositories, leaked API keys sitting in prompt history, and compromised coding hooks. MEDUSA is a scanner aimed squarely at that gap, with more than 40,000 detection patterns that cover AI supply chain attacks alongside familiar targets like Log4Shell and Spring4Shell. You can point it at a repository to learn what you are about to clone, scan your Claude or Cursor setup for exposed keys and suspicious hooks, or run a plain scan over an existing codebase with no configuration. It installs from PyPI as a single command-line tool, so a small team without a dedicated security engineer can screen what it is about to rely on without much ceremony.