Security Monitor

You fixed it in the repo. Is production still vulnerable?

Türkçe

_{Demo recorded from the desktop UI with sample data (lodash 4.17.20, GHSA-35jh-r3h4-6jhm); no real scan or server.}

Security Monitor (secmon) is an open-source, local-first security monitor for your projects and your Linux servers. It matches your dependencies against vulnerability advisories on your own machine, then checks what is actually running in production, so a fix that never got deployed does not look finished.

No account. No cloud dashboard. Source code, lockfiles, and inventory stay on your device unless you approve a specific transfer.

Status: pre-release. v1.0 is code complete; signed installers are not published yet. Build from source to try it. Missing, stale, or unverified data is always shown as could not verify, never as safe.

What it does

• Finds vulnerable dependencies locally. Lockfile inventory, offline OSV data, GHSA, CISA KEV and EPSS, plus OSV-Scanner, Trivy, and Semgrep adapters.
• Compares the repo with production. A read-only Linux agent (or agentless SSH) reports what is installed and running, including kernels that need a reboot and processes still using deleted libraries.
• Warns before vulnerable code is pushed. secmon hook checks only the changed lockfiles, offline, in under three seconds.
• Works with your coding agent. One command connects Claude Code, Codex, or OpenCode to a local MCP server and Security Monitor skills.
• Prepares fixes you approve. Fixes are prepared in an isolated Git worktree and tested in a network-disabled sandbox; nothing is applied without your approval.

Why it is different

Security Monitor uses OSV-Scanner, Trivy, and Semgrep as local adapters; it builds on them rather than replacing them.

How it works

flowchart LR
  subgraph Device["Your device"]
    Repo["Projects and lockfiles"] --> Engine["Local inventory and matching"]
    Scanners["OSV-Scanner, Trivy, Semgrep (local)"] --> Engine
    Engine --> Store[("Local SQLite")]
    Store --> Desktop["Desktop app and tray"]
    Store --> CLI["secmon CLI, Git hooks, SARIF / CycloneDX / OpenVEX reports"]
    Store --> MCP["Local MCP server"]
    MCP --> Agents["Claude Code, Codex, OpenCode"]
  end
  Server["Linux server: read-only agent or agentless SSH"] -- "approved, pinned SSH" --> Engine
  Feeds["OSV, GHSA, CISA KEV, EPSS, cve.now, RSS/Atom"] -- "only with public downloads on" --> Engine
  Desktop -. "reviewed and approved request" .-> AI["Optional AI provider you choose"]
  Desktop -. "approved destinations" .-> Notify["Webhook, Slack, Discord, email"]

The agent has no remote-command feature: it runs only a fixed, compile-time list of read-only collectors and never needs root.

Privacy: what leaves your device

See Privacy for the full model.

Quick start (from source)

Install Rust, Node.js 22 or newer, pnpm 10.27.0, and the Tauri prerequisites.

pnpm install --frozen-lockfile
pnpm -C apps/desktop tauri dev

CLI:

cargo run -p secmon -- scan <project-path> --offline
cargo run -p secmon -- report --format sarif
cargo run -p secmon -- hook install --pre-push --mode warn
cargo run -p secmon -- integrate claude-code --dry-run

Linux agent: build the static binary, verify its checksum, and install it with the provided script. Confirm the SSH host-key fingerprint independently before pairing. See Linux agent installation.

With coding agents

secmon integrate <claude-code|codex|opencode> --dry-run
secmon integrate <claude-code|codex|opencode>
secmon integrate remove <claude-code|codex|opencode>

This adds the local MCP server, the Security Monitor skills, and, where supported, a hook that runs secmon hook run before the agent pushes. --dry-run shows the exact diff, and remove restores the previous files. Agents can read findings and leave notes; they cannot change a finding's status or priority. See Coding-agent integrations.

Screenshots

Screen	Light	Dark
Findings
Projects
Servers
History
Settings

Screenshots come from the deterministic test fixture, not a real scan or server.

Documentation

Full documentation: umitaltinozzz.github.io/security-monitor

• Using it: CLI · Linux agent installation · Coding-agent integrations · AI providers · Local MCP · Shared local memory
• How it works: Architecture · Scanner adapters · Finding correlation · Repository-to-production drift · Deploy ID · Scan orchestration and notifications
• Trust: Privacy · Threat model · Data sources · Signed releases and updates · Performance budgets

Contributing and security

Read CONTRIBUTING.md before making changes. Use the issue forms for bugs, feature requests, and false-positive reports, and Discussions for questions, setups, and ideas. Report vulnerabilities privately as described in SECURITY.md, not in a public issue.

License, data, and disclaimer

Source code is licensed under Apache-2.0. Vulnerability and advisory data keep their own source licenses; see Data sources. cve.now summaries are attributed to cve.now under CC BY 4.0. This product uses data from the NVD API but is not endorsed or certified by the NVD.

A missing finding is not proof that software or an environment is secure. Verify results against the original advisory and your own environment before making security decisions.