Security CLI for your coding agent

Your repository scanner cannot see the key your app actually runs on. The CLI scans your live working tree — uncommitted files, .env.local, actually-installed packages.

$ npx coprompt watch
watching working tree · silent mode
edit  lib/supabase/client.ts
■ critical  service role key in client bundle
edit  .env.local
◆ high      SUPABASE_SERVICE_ROLE_KEY present
reported to app.coprompt.dev · nothing uploaded but findings

.env.local

Where your real keys live — including whether the app runs on a service role key.

The working tree

Code your agent generated minutes ago, before commit, where a fix is cheapest.

Installed packages

What is actually in node_modules, not what the lockfile claims.

Give your agent the check

{
  "mcpServers": {
    "coprompt": {
      "command": "npx",
      "args": ["coprompt", "mcp"]
    }
  }
}

One step in CI

- name: coprompt
  run: npx coprompt scan --ci
  env:
    COPROMPT_TOKEN: ${{ secrets.COPROMPT_TOKEN }}