jankhunt42
features

Four questions. Four commands.

Offline by default, with a receipt for every claim. Each command prints a terminal view, Markdown when piped, --json, or one offline --html file.

scan

What is broken?

Leads across code, CI, containers, secrets, low-code exports and AI-agent workspaces, worst first, each with file, line and evidence. It knows the mistakes AI-built apps make: secrets behind NEXT_PUBLIC_ prefixes, open Firebase rules, missing row-level security.

Every finding comes with a prompt for your coding agent to fix it. The Jank Score says where to look first; it does not certify safety.

jankhunt42 scan .
jankhunt42 scan . --prompt
jankhunt42 scan . --sarif > jank.sarif
Terminal scan view: the code autopsy banner, a Jank gauge at 69 out of 100 graded E with the label biohazard and policy fail, the three dimension bars, top offenders and rules, and the first finding with its evidence, why and fix.
map

What can it reach?

A connectivity graph built from repository text: databases, APIs, cloud services, identities and the AI agent’s tool servers, with a file and line for every edge. It shows the blast radius, what each credential unlocks, and an exposure class from Low to Critical.

A path is a possibility, not proof of access. Unknown is never treated as safe.

jankhunt42 map .
jankhunt42 map . --html > map.html
jankhunt42 map . --base HEAD~1
HTML blast radius explorer: summary cards, the connectivity graph with the application’s integrity reach highlighted in magenta towards the ledger database, an S3 bucket, a Redis cache and external endpoints, and an inspector panel for the restricted production ledger database.
passport

Can it ship?

Ownership, data, AI use, tests, change control and package sources, joined into one decision: pass, review, insufficient evidence or block, each with the rule behind it. A passport is never an approval.

The citizen profile is strict. It needs an owner, an engineering custodian named by IT, observed tests and CI, and classified data. It blocks on exposed secrets, bypassed agent guardrails or exposure above Moderate, and explains itself in plain words.

jankhunt42 passport . --profile citizen
jankhunt42 passport . --base main --md
jankhunt42 passport . --fail-on block
HTML citizen passport: release assessment block under the citizen profile with no custodian named, exposure High, and the plain-language brief with nine blocking reasons, the most serious problem found, what the software can reach and the AI service it uses.
sandbox

What does it try when run?

Opt-in. Runs the install hooks, each dependency as it loads, and what runs on folder open, in a rootless container with no network, a read-only root and canary credentials. It reports every attempt like a firewall log.

It adds to the static findings and never refutes them.

jankhunt42 sandbox .
jankhunt42 sandbox . --fetch https://registry.npmjs.org/
Terminal sandbox run: 3 ALERT and 3 DENY with complete coverage of the install, import and open surfaces; an npm postinstall and a VS Code folder-open task ran; the audit log shows canary reads of the AWS credentials file and the npm config, a persistence attempt on the shell startup file, two DNS lookups and a blocked connection to 203.0.113.9 on port 443.
Agents Rule of Two

Three capabilities. One risky combination.

A prompt injection can turn what an agent reads into what it does. jankhunt42 checks whether the same agent has all three:

  • A · input

    Text others can write

    Web pages, messages, public issues or an open webhook.

  • B · data

    Something private

    Files, databases, mailboxes or private repositories it can reach.

  • C · action

    A way to act

    Changing data, sending a message or fetching an address it chooses.

It reads MCP client configurations and n8n AI Agent workflows, including the permissions around them. Findings name the tools behind the combination and whether their actions need a person’s approval.

Remove one capability from the combination, or require approval for every action. See how approvals change the passport decision.

jankhunt42 scan . --rule JH714 --min-severity info
jankhunt42 passport . --profile citizen

Configuration shows possible capabilities, not what an agent actually did. Unknown servers do not contribute to the combination; findings list them when present.

Also built in

  • --emit-sandbox-policy

    Agent sandbox policies

    A least-privilege network policy for Claude Code, Codex, OpenShell or Agent Substrate, from what the code reaches. Production hosts stay out; IT can cap it with an approved list.

  • scan --category agent

    AI agent and MCP checks

    Approval bypasses, open agent sandboxes, unpinned MCP servers, hidden instructions, and skills that pre-approve any shell command.

  • scan · map

    Low-code readers

    scan reads Power Platform solutions, canvas apps, Copilot Studio agents, n8n workflows, and Supabase migrations as one database; map graphs the n8n workflows. Nothing is run.

  • passport --sandbox-log

    Agent sandbox logs

    Reads OpenShell and Agent Substrate logs and flags connections, allowed or blocked, to destinations the repository does not declare.

  • passport --json

    AI governance

    An inventory of the AI services it can reach. Rules map to NIST AI RMF, AIGP and OWASP risks: orientation, not compliance.

  • review

    Diff review

    Receipts for a committed or staged change, new lines told apart from context, and baselines for CI.

Every rule, option and limit is in the README and its reference guides on GitHub.