Review
“Auditor removed a lot of review noise for us. Instead of re-explaining the same auth and secrets issues on every PR, the guardrails were already there when the code was generated.”
L
LucaStaff Engineer
Your AI now auditsSQL Injection
with parameterized query rules
Context-aware security rules for AI-generated code in Claude Code, Cursor, and Windsurf.
Install for
$npx -y -p @auditormcp/mcp auditor install --client claude
Exploitation risk benchmarking
Impact measured across thousands of AI-generated code reviews.
Risk of exploitation in AI-generated code, before and after Auditor
Without Auditor
With Auditor
Set it once. Secure everything.
Auditor plugs into your AI tools and enforces security rules tailored to your stack on every generation.
The new threat landscape
AI is now writing the exploits too.
In the last twelve months, AI-assisted attacks moved from research papers to the front page. The same models writing your features are being used to find vulnerabilities, draft exploits, and run entire attack chains end-to-end.
The StarFeb 2026
Hacker uses Claude AI to steal 150GB of Mexican government data
An attacker used a commercial coding model to find vulnerabilities, generate exploits, and exfiltrate millions of taxpayer records end-to-end.
Read storyBusiness InsiderNov 2025
AI now automates 80–90% of cyberattack workflows
Researchers report attackers offloading reconnaissance, exploit drafting, and lateral movement to AI agents — collapsing the cost of offense.
Read storyAP News2026
State-linked AI campaign targets banks, energy grids and software vendors
Authorities warn of coordinated, AI-driven intrusions hitting critical infrastructure and supply chains across multiple countries.
Read storyWiredApr 2026
Leaked Claude Code is being reposted with bonus malware
After a 500K-line source leak, attackers began distributing trojanized builds of the tool — turning the leak itself into an attack vector.
Read storyMeet the founders
AI specialist & Head of R&D at a fintech company
Building the security layer between LLMs and production code. AI research & fintech background.Building the security layer between LLMs and production code. Background in AI research and fintech systems, with a focus on shipping developer tools that are fast, practical, and secure by default.
Cybersecurity expert · ex-Siemens & Guidewire
Designs Auditor's core security engine. Enterprise cybersecurity background.Designs the core security engine behind Auditor. Background in enterprise cybersecurity, now focused on bringing production-grade security practices into everyday developer tooling.
Works with
anything
you use
VSCode
Claude
Cursor
OpenAI
N8N
Windsurf
VSCode
Claude
Cursor
OpenAI
N8N
Windsurf
VSCode
Claude
Cursor
OpenAI
N8N
Windsurf
VSCode
Claude
Cursor
OpenAI
N8N
Windsurf
Teams using Auditor
Short reviews from engineers using it in practice.
Review
“What stood out was how practical it felt. The setup took minutes, the MCP flow was clean, and the output actually matched the stack we run in production.”
N
NinaPlatform Lead
Review
“We use AI heavily, but the security drift was real. Auditor made codegen much more trustworthy without slowing the team down or adding another review checklist.”
M
MateoApplication Security
Commonquestions
Auditor is a CLI + MCP workflow for AI-assisted security reviews. The CLI detects your stack, writes auditor.json, and the MCP server uses that context to fetch the most relevant security rules for the project.
Auditor detects your language, frameworks, and deployment context, computes a stack fingerprint, and creates auditor.json. If you are signed in, it can also sync hashed project metadata and stack info to the Auditor backend.
Not for local setup. You can run init, update, status, and doctor without an account. But fetching rules through the MCP server and syncing projects to the backend requires authentication via auditor login.
The built-in installer supports Claude, Cursor, and Windsurf. Auditor runs as a stdio MCP server, so other MCP-compatible clients can be wired manually if needed.
Auditor detects Node.js, Python, Go, and Java projects. It also tags common frameworks and tools such as Express, Next.js, Nest, Fastify, Prisma, Sequelize, TypeORM, Mongoose, React, GraphQL, JWT, FastAPI, Django, Flask, SQLAlchemy, Pydantic, plus Docker and Kubernetes context when present.
No source code is uploaded for stack detection. Auditor reads manifest files locally to infer the stack. When you sign in, it can send project metadata such as project name, path hash, language, frameworks, context, fingerprint, and rules queries based on tags.
init creates auditor.json for the first time. update refreshes it only when the stack fingerprint changes. audit runs update and then prints the prompt to use Auditor in your AI client. doctor checks your environment, backend connectivity, and authenticated rules access.
Run auditor update. Auditor recalculates the fingerprint from your manifest files and rewrites auditor.json only when the detected stack actually changed.