I write code with an AI agent every day. It is fast, it is careful, and on security it is quietly
out of date β not because it is careless, but because a model's training data has a cutoff, while
advisories are published every day. Ask your assistant whether a dependency is safe and you get an
answer shaped by whatever was public months ago.
So I built the missing part: a tool the assistant can call that reads today's public advisory
data, ranks it, and can prove a fix worked.
opencraysec β MIT, Rust, one static binary. A CLI and an
MCP server. No account, no API key, no telemetry. Your source code never leaves the machine.
curl -fsSL https://raw.githubusercontent.com/amgio38/opencraysec/main/scripts/install.sh | sh opencraysec update --for . # advisories for the ecosystems this project uses opencraysec scan .β¦
