whereismyai
Oss Scanner
Oss Scanner is a security scanner by Anthropic that finds vulnerabilities in open-source repositories.
OSS Scanner is a security scanning service by Anthropic that detects vulnerabilities in critical open-source repositories. Project owners enroll by opening a pull request that adds a directory containing a project configuration and a Dockerfile. The security scanner builds the project inside an isolated virtual machine with no internet access and analyzes it. It then emails the findings, along with a reproducer and a proposed patch when available, to the designated contacts. Reports are generated by models without human review, and findings are not publicly disclosed. Owners can optionally include a threat model document to guide severity ratings and scope.
Oss Scanner at a glance
Key features
- Builds projects in isolated virtual machines
- Runs security audits without internet access
- Emails vulnerability reports and proposed patches
- Supports project configuration via YAML files
- Accepts custom Dockerfiles for environment setup
- Accepts optional threat model documentation
- Supports encrypted reports via OpenPGP
Use it for
- Scan open-source repositories for security vulnerabilities
- Generate model-based vulnerability reports with patches
- Test builds locally before enrolling projects
Alternatives to Oss Scanner
- Epherem — Identifies security mistakes in AI-built code with suggested fixes for each one.
- OpenCode — Works with 75+ model providers, local models, and existing subscriptions
- SkillTotal — Scans code locally without accounts, telemetry, API tokens or executing the files.
- ShipOrNah — Checks AI-generated apps for exposed API keys and missing Supabase RLS.
- AiSOC — Runs locally without API keys with bundled models and auditable reasoning ledgers.
- Openscion — Handles massive monorepos by executing operations server-side and fetching only required files.
- Pixee — Automates vulnerability triage and generates actionable code fixes.
- OpenSandbox — Provides isolated environments with multi-language SDKs and lifecycle management.
- Stroq — Scans recorded sessions and guards future actions with local hooks.
- CodeScan Artex — It uses multiple parallel AI agents to read source code and verify vulnerabilities.
- ODS — Automates complex local AI infrastructure setups with one command.
- Mantis — Automates vulnerability discovery and patching using AI agents.
All Oss Scanner alternatives