Run Semgrep static analysis scan on a codebase using parallel subagents. Supports two scan modes — "run all" (full ruleset coverage) and "important only" (high-confidence security vulnerabilities). Automatically detects and uses Semgrep Pro for cross-file taint analysis when available. Use when asked to scan code for…
Use when planning security-sensitive features — authentication, authorization, data handling, API design, cryptography, or network configuration — requires explicit threat modeling before implementation decisions are made.
Use when performing threat modeling for a project, feature, or system architecture. Applies STRIDE threat categorization with DREAD risk rating to produce structured threat models in OTM JSON and markdown formats. Covers system decomposition, trust boundary mapping, data flow analysis, per-subsystem threat…
Use when about to claim work is complete, before committing or creating PRs - requires fresh verification evidence before any completion claim. Triggers on phrases like "done", "finished", "ready to commit", "all tests pass", "looks good", "should work", "I think that's it".
MCP server "deep-code-security" as configured in backspace-shmackspace/deep-code-security. Runs locally from the deep-code-security Python package.
★not rated 0 7mo agoA
tokens not measured
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: