A security scanner that reads your AI's diary

What it does

Medusa is a Python security scanner pitched at AI/ML codebases. It runs 9,600+ built-in detection patterns across 79 analyzers, looking for CVEs, leaked secrets, and “repo poisoning” — weaponized configuration files for AI editors like Cursor, Cline, and Copilot that can execute arbitrary code. It also scans your local shell and AI chat histories for leaked credentials (21 issuer types, from Anthropic to Stripe), with an interactive purge mode that redacts them in-place after making byte-identical backups.

The interesting bit

The secrets scanner is the standout: it targets a genuinely new attack surface. Developers paste API keys into AI assistants constantly; those conversations sit in plaintext JSONL files on disk. Medusa greps your ~/.claude/history.jsonl and ~/.bash_history, then offers [y/n/s/a/q] redaction with atomic writes and JSONL-safe markers. The repo-poisoning detection is similarly specific — it knows about 28+ AI editor config file types and named attacks like CurXecute (CVE-2025-54135) and Clinejection.

Key highlights

• Runs fully offline after pip install; no external tools required (optional linters auto-detected if present)
• Multi-core scanning with content-hash caching for rescans
• Exports to JSON, HTML, Markdown, SARIF
• Recent v2026.5.10 hardening release fixed command injection in the VS Code extension, a --fail-on caching bug, and stale tool-cache paths
• AGPL-3.0 licensed

Caveats

• The README claims “40,000+ detection rules” in the repo description but “9,600+ detection patterns” in the body — the discrepancy is unexplained
• “200 CVE detections” is stated without listing most of them; the named ones (Log4Shell, Spring4Shell, XZ Utils, LangChain RCE, MCP-Remote RCE, React2Shell) are a small subset
• Optional AI model scanning requires separately installing modelscan

Verdict

Worth a look if you’re shipping AI-adjacent code or using AI coding assistants heavily. The secrets scanner alone justifies the install for anyone who’s ever pasted a token into Claude Code. Traditional SAST users may find the AI-specific focus either refreshing or narrow, depending on their stack.