Security scanner for the AI supply chain — MCP servers, ML models, RAG corpora. Every artifact your AI agent loads is untrusted code or data. MCP servers execute code on your machine. ML model pickles ...

Merge note — kept local's # nosec B603 justification on the subprocess.Popen(args, **kwargs) call in cdp.py while adopting upstream's new kwargs (Windows creationflags) form AGENTS.md — new upstream ...