CodeSafer (cleaner-code)
AI code security scanner as a Model Context Protocol (MCP) server. Detects hidden threats in AI-generated code that traditional linters miss.
Website: codesafer.org · MCP Clients: Claude Code, Cursor, VS Code + Copilot, Cline
Why CodeSafer?
AI coding assistants generate code fast — but who's checking it for hidden threats?
Recent supply-chain attacks show that malicious code can hide in ways human reviewers and traditional linters routinely miss:
- Invisible Unicode characters injected into identifiers (30+ variants)
- BiDi / Trojan Source attacks that reorder how code is displayed vs. executed (CVE-2021-42574)
- Homoglyphs — Cyrillic characters masquerading as Latin (CVE-2021-42694)
- Glassworm-style Unicode steganography hiding payloads in whitespace
- Rules file backdoors planted in
.cursorrules,CLAUDE.md, and other AI config files - Typosquatted dependencies in
package.json - Obfuscation patterns —
eval+ base64, reverse shells, packed payloads
CodeSafer scans for all of these before the code runs on your machine.
