CodeGuard

Appearance

Security & Privacy ​

Your Code. Your Machine. Your Control.

CodeGuard is intended for local, read-only analysis. It does not execute the code it scans, make network requests, or offer MCP shell, write, or delete operations.

How CodeGuard works ​

CodeGuard is local static analysis. The engine scans your project, loads codeguard.config.json, and runs the enabled analyzers (TypeScript, JavaScript, Security, Architecture). Analyzers parse source with the TypeScript Compiler API and produce structured diagnostics. The same engine feeds the CLI (including watch) and the MCP server.

  1. Project Source FilesRead from your local disk, inside the project root
  2. CodeGuard Analysis EngineScan, ignore rules, configuration, rule engine
  3. Static AnalyzersTypeScript, JavaScript, Security, Architecture
  4. Structured DiagnosticsRule ID, severity, location, message, remediation
  • CLITerminal and JSON reports
  • MCP ServerRead-only tools and prompts over stdio
Analysis runs locally. Source files flow through the engine and static analyzers into structured diagnostics, which are delivered to the CLI and to the MCP server.

The Rules Explorer lists every security and architecture rule with examples and limitations.

What CodeGuard does not do ​

  • No project code execution. Analyzers read and parse files. Scanned code is never run, imported or evaluated.
  • No source modification. Analysis never edits, creates or deletes analyzed files. The only file CodeGuard writes is codeguard.config.json, and only when you run codeguard init and none exists.
  • No network requests from the analysis engine, CLI or MCP server.
  • No AI model calls. The MCP prompts review_project and explain_diagnostics return prompt text for your client; CodeGuard does not run a model or fix code.

Filesystem boundaries and project root ​

  • The MCP server requires --root, resolves it to a canonical directory, and scopes that process to the root.
  • analyze_file accepts relative paths only, rejects traversal and absolute paths, resolves symlinks, and checks the resolved file remains inside the root.
  • Scanning does not follow symlinks and applies built-in and configured ignore rules.
  • Common .env, private-key, and credential/token-named files are excluded.
  • Files above the default 1 MiB size, directory trees deeper than 64 levels, scans above 100,000 encountered entries, and scans above 20,000 supported files are constrained.
  • TypeScript Compiler API hosts are restricted to scanned project files, safe dependency declaration/configuration files, and TypeScript's standard library.

Filesystem checks cannot eliminate every race in a concurrently modified project. Analyze files from trusted workspaces, avoid changing symlink targets during analysis, and keep project dependencies/configuration controlled.

Ignored files and credentials ​

The default scan ignores node_modules, build output, .git, .env*, key and certificate files (*.pem, *.key, *.p12, *.pfx, id_rsa*) and names containing secret, credential, token or api-key. Add more patterns with the ignore setting in configuration. SEC004 findings never include the credential value. Other diagnostics, such as compiler messages, can still contain text from your source, so keep real secrets out of source files.

Security analyzer limitations ​

SEC001–SEC005 are deterministic syntax patterns. They can miss obfuscated or indirect execution and may flag code that is safe in its actual context. SEC004 recognizes only selected static credential-like assignments and cannot establish whether a value is a live secret. Findings are potential risks to review, not a security certification.

MCP diagnostic messages redact nested string-literal type text, but that is not a general-purpose secret detector for every compiler, path, or future message format. Avoid embedding credentials in source code and do not treat the absence of findings as proof of safety.

MCP is read-only ​

The MCP server exposes analysis tools (analyze_project, analyze_file, get_diagnostics, get_security_issues, get_architecture_issues, get_project_info) and two prompts. None of them runs commands, writes files or deletes files. Results are limited to the configured --root.

CodeGuard compared with AI assistants ​

CodeGuard is a deterministic rule-based analyzer that runs on your machine and sends nothing anywhere by itself. An AI assistant is a separate product: it may send prompts and context to a model provider. CodeGuard findings are reproducible for the same code and configuration; AI output is not.

Privacy when using MCP with third-party AI clients ​

CodeGuard itself makes no network requests, but the MCP client that calls it may. Diagnostics returned over MCP (file paths, line numbers, messages and remediation text) become part of the client's conversation and may be sent to that client's model provider under its own privacy terms. Review what your client shares, use a client you trust, and point --root only at projects you are comfortable exposing to it.

Supported boundaries ​

  • Analysis is confined to the configured project root and the scanner limits above.
  • CodeGuard is not a sandbox: it does not isolate your operating system from a malicious workspace, and it does not defend against a compromised MCP client or host.

MCP clients ​

The MCP server grants the connected host access to analysis within its configured root. Keep that host and configuration trusted. Use separate server instances for separate project roots, and do not expose stdio through an unauthenticated remote bridge.

To report a vulnerability privately, use the repository's GitHub Security Advisories feature. The repository-level security policy describes what to include in a report.