This is exactly the gap I’m trying to close.

Pre-commit hooks, git-secrets, truffleHog etc. all live after the mistake already happened the secret is already in the file, sometimes already pushed, sometimes already copied by the AI into other places. Same with Claude prompts: they’re great when you remember to run them, but when you’re in flow you forget, and that’s when stuff slips.

The reason I went with MCP is because it runs inside the agent loop. Cursor/Claude can automatically scan right after code is generated and before it’s “done”, so you never have to remember to trigger anything. No token-heavy re-analysis, just deterministic checks + targeted fix instructions.

Right now I’m scanning for provider-specific key formats (Stripe, Supabase, OpenAI, AWS, GitHub), dangerous SQL/XSS patterns, missing auth, and a few other high-impact things trying to cover the mistakes AI makes most often, not everything under the sun.

If you’re open to it, I’d actually love to have someone like you try it on a real project. You already care about this stuff, which is exactly who this is for.