Open source · v0.2.0

Security review for code still in motion.

Owlwarden scans Node web apps where you work. It returns the vulnerable line, why it matters, a fix written for your framework, and a confidence level you can act on.

$ npx owlwarden scan

View the source Read the documentation

12frameworks, each with specific remediation

12high-signal rules in the zero-config scan

9 of 10OWASP Top 10 categories reached—and the gap is published

Evidence, not a ticket

The answer belongs beside the problem.

A finding should not send you on a scavenger hunt. Owlwarden includes the exact location, readable context, impact, and a fix you can use without opening another browser tab.

stack-trace-leak likely

High Next.js · GET /api/users A05:2021 · CWE-209

Stack trace leaked in error response app/api/users/route.ts:13

11 │   } catch (err) {
12 │     return NextResponse.json(
13 │       { error: err.stack },
   │                └─ leaks internal structure
14 │       { status: 500 }

Fix / Next.js

Return a generic message; log the error server-side.

console.error(err)
return NextResponse.json({ error: 'Internal Server Error' }, { status: 500 })

For coding agents

Spend model judgment where judgment is needed.

Owlwarden handles repeatable baseline checks locally, then gives the agent a bounded, structured result. Keep the model for architecture, authorization boundaries, and the decisions a parser cannot make.

npx owlwarden mcp

The MCP server is static-only, read-only, workspace-scoped, and cannot trigger network probes or write a “fix.” Scan and plugin text is wrapped as untrusted evidence, not instructions.

scan_project: Run the project scan and return typed JSON.
scan_file: Filter a project scan to the file in the edit loop.
explain_rule: Return rationale and every framework-specific fix.
list_rules: Expose the compiled catalogue, not a stale copy.

The standard

A scanner earns trust by knowing when to lower its voice.

Security tools usually fail in one of two directions: they say too little to help, or too much to believe. Owlwarden treats a false positive as a product failure, not collateral damage.

Every finding carries confirmed, likely, or possible. Static analysis can never claim “confirmed”; that level requires a passive runtime probe to agree with the source. Possible findings stay visible but do not fail CI on their own.

The result is practical: developers know what deserves attention, and coding agents are less likely to edit good code because a heuristic sounded certain.

Built for the edit loop

A reliable floor. Judgment still goes on top.

Local unless you opt in

The default scan reads your project and makes no network requests. Nothing leaves your machine. No telemetry. Runtime checks only happen when you provide a target, and every redirect remains inside the scope you declared.

Frameworks are understood, not guessed

Owlwarden recognizes how each framework receives requests, sends responses, sets cookies, registers routes, and configures headers. The fix matches the stack it found.

One truth for people and tools

The human report and JSON come from the same finding model. Schemas are checked across Rust and TypeScript in CI, so agents do not receive a convenient fiction that the engine never emitted.

Twelve stacks, fully named

Specific advice beats “check your framework docs.”

Every shipped rule has remediation for every supported framework. A test fails the release if one is missing.

Next.js
Nuxt
NestJS
Express
Fastify
Hono
Koa
Hapi
Sails.js
Astro
Remix
Gatsby

An honest coverage map

Clean means “nothing found here.” It never means “nothing is wrong.”

What it can see

Injection, insecure response behavior, unsafe request destinations, leaked secrets, weak cryptography, supply-chain mistakes, logging risks, and misconfiguration patterns across Node web apps.

Read all twelve rules

What source cannot prove

OWASP A04:2021 — Insecure Design needs product intent, runtime context, or a human threat model. Owlwarden marks it out of reach instead of mapping a narrow rule to a broad promise.

See the coverage method

Plain answers

Before you put it in the loop.

What does Owlwarden scan?

TypeScript and JavaScript web applications, with first-class framework knowledge for Next.js, Nuxt, NestJS, Express, Fastify, Hono, Koa, Hapi, Sails.js, Astro, Remix, and Gatsby. Other Node projects receive a generic scan where a rule does not need framework context.

Does the default scan send code anywhere?

No. Static scans are local, offline, and have no telemetry. Network access only begins when you explicitly pass --target; those passive probes are deny-by-default and limited to the origin or scopes you name.

Is it a replacement for a security review?

No. It is a fast, repeatable security floor for every edit and every CI run. High-impact work—authentication, payments, personal data, authorization design—still deserves deeper human and AI-assisted review.

Can an agent change files through Owlwarden?

Not through the shipped MCP server. It can scan, inspect one file, explain a rule, and list the catalogue. The MCP surface is read-only and static-only. Autofix is planned, but it is not part of version 0.2.0.

How is noise controlled?

Rules declare a maximum confidence; request-origin analysis is intentionally shallow and shared across rules; possible findings do not fail CI alone; and every tempting clean case added to the fixture corpus must remain silent.

Watch the code that ships

Start with the line in front of you.

$ npx owlwarden scan

Open source · MIT or Apache-2.0 · Node 20+ · macOS, Linux, and Windows