kubeek-sec/deep-scan

Deep Scan is a security scanning project made up of several connected pieces that all share one underlying scanning engine. That same engine is exposed in four ways: as an MCP server for AI agents and code editors, as a command line tool for local use and continuous integration pipelines, as a REST API with a web app for running many scans at once, and as a continuous scanning fleet with a dashboard for tracking security posture across many projects over time. It bundles more than 20 individual scanning tools covering static code analysis, dependency vulnerabilities, exposed secrets, infrastructure configuration issues, license checks, malware detection, and dynamic application testing. Every scanner's results are normalized into one shared finding format, deduplicated, and rendered into JSON, Markdown, HTML, or the SARIF format used by many code review tools. A separate, non AI code graph analysis engine can trace which vulnerable dependencies are actually reachable from a program's entry points, cutting down on findings that do not matter in practice. An optional AI powered triage step can also prioritize findings and suggest fixes, and it can run against a local model to avoid sending code externally. A key feature is that an AI agent can drive the MCP server through an entire remediation loop: scanning a project, confirming which findings are truly reachable, then opening a separate review branch for each group of fixes with a minimal patch and a test proving the issue is resolved. The project also includes a deliberately vulnerable sample application for trying out the scanner safely. For running the full stack, including the database, the scanning worker fleet, the web app, and the MCP server, Docker Compose brings everything up with one command. On Kubernetes, the scanning workers can be hardened further and even run inside gVisor, a sandboxing technology, since scanning unfamiliar code is inherently risky. The project is written in Python using the uv tool for dependency management.