Zero-Trust DevSecOps Shield for AI Coding Agents

Stop Insecure Code Before It Ships to Production

Equip Claude Code, Cursor, and Antigravity with 28 Native MCP Tools. Audit codebases, block command injections, discover secrets, lint Dockerfiles, and enforce zero cloud code leaks with 100% local deterministic AST execution.

codeguard-ci --strict --diff Zero Runtime Deps

[2026-10-25 00:00:12] codeguard-mcp v4.1.0 initializing 28 MCP security engines...
[Pillar 1: Security] Scanning AST graph for SSRF, Shell Injection, and Hardcoded Secrets...
🚨 CRITICAL Line 42: child_process.exec(`ping -c 1 ${req.query.host}`) [CWE-78: Command Injection]
🚨 CRITICAL Line 88: AKIAIOSFODNN7EXAMPLE [CWE-798: Hardcoded AWS Access Key]
[Pillar 2: Reliability] Inspecting Dockerfile root user & dependency SCA CVEs...
⚠️ HIGH Dockerfile line 1: Base image node:18 is EOL. Migrate to node:22-bookworm-slim.
[Auto-Remediation] Generating unified git patch diff with in-memory AST verification...
✓ Patch Verified: Replaced exec() with parameterized execFile() and bound process.env credentials.
🛡️ Final Verdict: SARIF 2.1.0 Report generated. Pre-production barrier enforces compliance.

🔒 Pillar 1: Security

Adversarial SAST scanning. Blocks SSRF, cloud metadata access (169.254.169.254), command injection, and API secret leaks.

⚡ Pillar 2: Reliability

Deterministic static checks. Detects unbounded event loops, timer leaks, unindexed foreign keys, and synchronous I/O.

🐳 Pillar 3: Containers

Shift-left Dockerfile linter and image CVE scanner. Enforces non-root execution, multi-stage builds, and minimal attack surfaces.

🌐 Pillar 4: Network

DAST port prober, OWASP security header auditor, TLS/SSL certificate analyzer, and DNS subdomain takeover protection.

Agent Development Environment Orca Compatible Zero Runtime Deps

CodeGuard Studio ADE: Parallel Agent Fleets in Isolated Git Worktrees

Run Claude Code, OpenAI Codex, and Grok Bot side-by-side in independent branch sandboxes with auto-injected DevSecOps MCP tools, continuous security sentinel diffs, and real-time live responsive Webview Design Mode.

28 Native MCP Tools for AI Coding Agents

Direct integration with Claude Code, Cursor, Antigravity, and GitHub Actions CI/CD.

codeguard_audit_preproduction

Comprehensive 4-pillar adversarial SAST scanner. Returns CodeRabbit-style blocking verdicts and vulnerability classifications.

SAST / Quality

codeguard_generate_fix

Synthesizes standard unified git diffs with in-memory syntax tree verification before proposing patches to developer.

Auto-Patch

codeguard_scan_web_vulns

Static analysis engine for web vulnerabilities: Reflected & Stored XSS, CSRF, open redirects, and prototype pollution.

SAST / Web

codeguard_hunt_secrets

Shannon entropy analyzer and multi-cloud credential hunter (AWS, GCP, OpenAI, Stripe, SSH private keys) with Git history audit.

Secret Vault

codeguard_scan_dependencies

Software Composition Analysis (SCA) for npm, pip, go.mod, and Gemfile. Flags vulnerable CVEs, EOL runtimes, and typosquats.

SCA / Supply Chain

codeguard_inspect_dockerfile

Shift-left container linter. Detects root execution, curl-pipe-sh, missing health checks, and unpinned base tags.

Container

codeguard_probe_ports

Fast, non-blocking zero-dependency TCP socket scanner. Audits open ports and detects exposed administrative services.

DAST / Network

codeguard_inspect_http_headers

OWASP ZAP-style HTTP header auditor. Validates HSTS, CSP, X-Frame-Options, CORS, and cookie security flags.

DAST / HTTP

codeguard_audit_tls

Cryptographic TLS/SSL inspector. Flags certificate expiration, weak cipher suites, self-signed certs, and SNI errors.

TLS / Crypto

codeguard_audit_dns

DNS security analyzer. Detects missing SPF/DMARC/DKIM email records, CAA misconfigurations, and dangling CNAME takeovers.

DNS Security

codeguard_export_sarif

Exports standard OASIS SARIF v2.1.0 for seamless native ingestion into GitHub Code Scanning and GitLab Security Dashboards.

Compliance

codeguard_zero_trust_report

Composite master orchestrator that aggregates SAST, DAST, SCA, Secrets, and Network findings into a single Trust Score.

Master Hub

Live Security AST Playground

Test CodeGuard's real-time static analysis, vulnerability classification, and automated git patch remediation.

Load Vulnerable Preset:

Source Code Editor

Live Analysis & Remediation Diff

Click "Run CodeGuard AST Scan" to analyze the snippet with CodeGuard's adversarial engines.

Orca Architecture AZUNO Cyberpunk Design System 100% On-Device

CodeGuard Studio: Autonomous Agent Development Environment (ADE)

Inspired by Stably AI's Orca (104k+ stars), CodeGuard Studio is the high-performance ADE engineered for parallel agent orchestration. Every agent gets an isolated Git worktree, continuous AST vulnerability sentinel scanning, automated 1-click git patch remediation, and live responsive frontend Design Mode.

Quick Launch on Developer Workstation

1. Launch Web ADE

npm run studio

Starts local HTTP IDE on http://127.0.0.1:18080

2. Launch Desktop App

npm run desktop

Native Electron window with embedded Studio Server

3. Upstream Orca Bridge

npm run orca:bridge

Registers CodeGuard MCP into upstream stablyai/orca

⚡ Parallel Agent Fleet Orchestration

Spawn multiple specialized CLI agents simultaneously in independent Git worktrees (.codeguard/worktrees/<branch>). Comes pre-configured with 1-click launchers for Claude Code, OpenAI Codex, Grok Bot, and Custom Shell CLI.

🛡️ Automatic DevSecOps MCP Injection

Every agent sandbox is automatically provisioned with .mcp.json and .codeguardrc.json. Your agents immediately inherit all 28 native tools for SAST, DAST, Container Auditing, Shannon Secret Hunting, and SARIF export without manual configuration.

🔍 Continuous Worktree Sentinel & 1-Click Patches

As AI agents edit code in their worktree, CodeGuard Sentinel continuously evaluates changes for Command Injection (CWE-78), Secret Leaks (CWE-798), Path Traversal (CWE-22), and XSS (CWE-79). Generates verified unified git diffs with 1-click "Apply Patch" auto-remediation.

📱 Live Responsive Webview Design Mode

Embedded design viewport with 1-click toggles for Desktop (Fluid), Tablet (768px), and Mobile (375px) viewports. Preview agent frontend changes live in real-time alongside your terminal and code editor.

CodeGuard Studio Control Plane • 4 Active Fleets Trust Score: 94/100 [A]

[Fleet 1: claude-code] agent-claude-91 running in .codeguard/worktrees/feat-auth-security
[Fleet 2: codex] agent-codex-44 running in .codeguard/worktrees/refactor-db-pool
[Fleet 3: grok-bot] agent-grok-12 running in .codeguard/worktrees/fix-xss-sanitize
[MCP Injector] Injected 28 security tools into all 3 worktrees: OK
[Sentinel] Scanned feat-auth-security: 0 Critical, 0 High • Trust Score: 100/100 [READY FOR MERGE]
[Sentinel] Scanned fix-xss-sanitize: 1 Finding [CWE-79: React XSS] • Auto-patch generated: PATCH-CWE-79-01
✓ Merge Gatekeeper: Zero-Trust policy enforced (Requires Score ≥ 80 & 0 Critical).

Open Local Studio Web IDE (Port 18080)

Download CodeGuard Desktop & CLI Engines

Direct Cloudinary Global CDN delivery with authenticated user access and SHA-256 integrity verification.

Detected Platform: Linux

Cloudinary dedicated repository folder: codeguard/releases/

Instant CDN Mirror

Windows 10 / 11

Native 64-bit and ARM64 desktop application with system tray daemon and local MCP bridge.

Package: codeguard-windows-v4.1.0.zip

Size: 131 KB • Release v4.1.0

macOS Sonoma / Sequoia

Universal binary for Apple Silicon (M1/M2/M3/M4) and Intel Macs with macOS Keychain security integration.

Package: codeguard-macos-v4.1.0.zip

Size: 130 KB • Release v4.1.0

Linux CLI & Server Engine

Zero-dependency server engine for Ubuntu, Debian, Fedora, Arch, and Alpine with Docker daemon integration.

Package: codeguard-linux-v4.1.0.tar.gz

Size: 140 KB • Release v4.1.0

Or Install Directly on Linux / macOS via Terminal

Run this single verified shell script to install and register CodeGuard MCP automatically:

          curl -fsSL https://codeguard.azuno.dev/connect.sh | bash
          
        

Enterprise DevSecOps Scenarios

Real-world architectures protected by CodeGuard across development life cycles.

1. Guardrails for Autonomous Coding Agents

When AI coding models (Claude 3.7 Sonnet, GPT-4.5) generate full-stack microservices, they frequently hallucinate insecure defaults: exec(req.query), unindexed foreign keys, or open CORS. CodeGuard acts as a zero-trust AST barrier that rejects unsafe diffs before they are written to disk.

2. GitHub Actions PR Security Gatekeeper

Integrate codeguard-ci directly into GitHub Actions workflows. It analyzes PR diffs, parses modified files into AST graphs, checks for credentials, evaluates Dockerfiles, and exports compliant OASIS SARIF v2.1.0 to block merging on CRITICAL vulnerabilities.

3. Zero-Leak Healthcare & Financial Systems

Organizations with strict data governance cannot transmit proprietary code to third-party cloud scanners. CodeGuard executes 100% locally on developer workstations with zero npm runtime dependencies, ensuring HIPAA, SOC 2, and PCI-DSS compliance.

4. Remote VPS & Cloud Node Fleet Enrollment

Enroll and secure remote Ubuntu/Debian production servers in seconds using /connect.sh. CodeGuard inspects Docker daemon sockets, audits exposed listening ports, validates TLS certificate chains, and streams telemetry back to the centralized dashboard.

Transparent, Value-Driven Pricing

All plans include zero cloud code leaks and 100% local deterministic execution.

Community Tier

$0 / forever

For open-source builders and individual developers.

✓ All 28 Native MCP Tools
✓ 100% Local AST Scanning
✓ 3 Cloud Vault Snapshots
✓ 1,000 MB Disaster Recovery Quota
✓ GitHub Actions SARIF v2.1.0 Export

Developer Integration Guide

Configure Claude Code, Cursor, and Antigravity to connect with CodeGuard MCP.

Claude Desktop / Claude Code Config

Add this to your claude_desktop_config.json:

{
  "mcpServers": {
    "codeguard": {
      "command": "node",
      "args": ["/absolute/path/to/CodeGuard MCP/index.js"],
      "env": {
        "CODEGUARD_API_KEY": "YOUR_API_KEY_HERE"
      }
    }
  }
}

Cursor / Antigravity MCP Config

Add this to ~/.cursor/mcp.json or Antigravity settings:

{
  "mcpServers": {
    "codeguard": {
      "command": "npx",
      "args": ["-y", "@codeguard/mcp"],
      "env": {
        "CODEGUARD_STRICT_MODE": "true"
      }
    }
  }
}

Developer Console & Cloud Vault

Live production telemetry synced with PostgreSQL and Firebase Identity.

Active Subscription

Pro Developer

$19.00 / month

Cloud Snapshots Stored

0 / 20

Encrypted SHA-256 Vault

Cloud Storage Used

0.0 MB

5,000 MB Quota

Database Engine

PostgreSQL

Native Port 5432 (Isolated)

License & Desktop API Key

Authenticate your local CodeGuard Desktop, MCP client, and CI/CD pipelines with this key:

          sk_live_...
        

Disaster Recovery Cloud Snapshots

Stored across encrypted multi-cloud S3 & Supabase vaults.

No Cloud Snapshots Uploaded Yet

Run codeguard_cloud_backup in your local MCP engine or CLI to create an encrypted snapshot.

👑 Super Admin Fleet Control Deck Superadmin Exclusive

Role-Based Access Control, Cloudinary release uploads, and live server diagnostics.

Cloudinary Dedicated Release Center (codeguard/releases/)

Manage desktop binary delivery packages for Windows, macOS, and Linux stored on Cloudinary (Cloud: dhww31v0g).

Platform	Binary Filename	File Size	Local Status	SHA-256 Checksum	Cloudinary CDN Actions

Registered Fleet Accounts (100% Real from PostgreSQL)

Adjust user roles (Developer, Admin, Superadmin), upgrade plan quotas, or rotate fleet keys.

User ID	Account / Email	Current Role	Change Role	Subscription Tier	API Credential	Actions

Server Host & PostgreSQL Engine Diagnostics

Node.js Memory (RSS)

-- MB

Process Uptime

-- min

PostgreSQL Database

Active