MEDUSA is a static security scanner aimed at AI and machine-learning code: LLM agents, MCP servers, RAG pipelines, and the configuration files that AI coding editors read. Its detection rules are built in rather than delegated, so a scan runs after installing the package with no external tool setup; external linters such as bandit, eslint, and shellcheck are auto-detected when present.
Beyond scanning a local path, medusa scan --git clones and vets a remote repository before you do, and medusa secrets scan searches AI assistant chat histories and shell histories for leaked credentials across 21 issuer types. The interactive medusa secrets purge takes a byte-identical backup, keeps JSONL parseable, refuses to run when the file changed between scan and purge, and writes atomically. --fail-on turns a scan into a CI gate.
Rule coverage is grouped by attack surface:
| Category | Patterns | Detects |
|---|---|---|
| Prompt injection | 800+ | direct and indirect injection, jailbreaks, role manipulation |
| MCP server security | 400+ | tool poisoning, schema poisoning, ATPA, sampling injection, rug-pull |
| Repo poisoning | 150+ | weaponized AI editor configs, Clinejection, CurXecute, IDEsaster, CamoLeak |
| RAG security | 300+ | vector injection, document poisoning, tenant isolation |
| Agent security | 500+ | excessive agency, memory poisoning, human-in-the-loop bypass |
| Model security | 400+ | insecure loading, checkpoint exposure, adversarial attacks |
| Supply chain | 350+ | dependency confusion, typosquatting, lock file backdoors |
| Traditional SAST | 1,400+ | SQL injection, XSS, command injection, secrets |
Version 2026.7.0 added structural vetting of .claude/ directories — poisoned hooks, over-broad permissions such as Bash(*) and bypassPermissions, wildcard-tool subagents, and dropper skills — an always-on attack-signature scanner for jailbreak and prompt-injection payloads in .jsonl and .csv data files, invisible-unicode and bidirectional-text recovery for Trojan Source (CVE-2021-42574), 22 native Rust rules, 16 native PHP rules, and a --trace-rules per-rule firing log with timings.
Features
- Built-in rule set: 40,000+ detection patterns and 79 scanner types spanning 41 language or tool scanners and 38 AI/ML security scanners, covering 100+ file extensions
- Remote repository vetting: medusa scan --git accepts a full URL, an org/repo shorthand, or a branch tree URL and flags 28+ AI editor config file types as attack vectors
- Secrets scanning and purge: 21 issuer types across AI providers, package registries, source forges, cloud, payments, and PEM private keys, scanned locally
- CVE detection: 200 entries including Log4Shell, Spring4Shell, the XZ Utils backdoor, LangChain remote code execution, MCP remote code execution, and React2Shell (CVE-2025-55182), matched against installed versions in package.json and lock files
- Agent protocol rules: 91 rules covering MCP, UCP, AP2, and ACP discovery endpoints, credential smuggling, and cross-tool exploitation
- False-positive filtering: 514 filter patterns, with a documented 96.8% reduction rate
- Report formats: JSON, HTML, Markdown, SARIF, and JUnit, with --format all in one run
- Editor integration: setup files and slash commands for Claude Code, Gemini CLI, OpenAI Codex, GitHub Copilot, and Cursor via medusa init --ide
- Incremental scanning: content-hash keyed caching skips unchanged files, --quick limits a run to changed files, and --force ignores the cache
- Parallel execution: multi-core scanning with automatic worker sizing that steps down under CPU, memory, or load pressure
- Project configuration: .medusa.yml sets enabled and disabled scanners, exclusions, the fail_on threshold, worker count, and editor integration
- Standards alignment: rules mapped to the OWASP Top 10 for LLM Applications 2025 and MITRE ATLAS
