deep scan tuto

What it is

Deep Scan, a PoC AppSec platform (deepscan-core / -cli / -mcp / -api) built as a uv workspace on Python 3.13. The blog post is its build log and tutorial, giving the concrete invocation and setup the summary omits. Explicitly a PoC: rough edges, no auth, much left to finetune.

How it works

Wrapped tools are downloaded pinned and SHA-256-verified rather than curl | bash-ed at runtime. Each scanner runs in a sandboxed subprocess, emits its native format (mostly SARIF), and is parsed into one Finding model. Findings deduplicate on the (location, message) key and render to six formats from one in-memory Report. A separate AI-free code-graph pass builds a call/data-flow graph and runs taint/reachability/choke-point analysis, flagging (not suppressing) findings no entry point can reach; a companion reachable-deps applies the same idea to SCA/CVEs.

What to do

Install and run:

uv sync
uv run deepscan tools install all   # pinned, checksum-verified binaries

uv run deepscan scan ./my-project
uv run deepscan scan http://127.0.0.1:3000

Static vs. dynamic mode is auto-detected. Reports land in reports/scan_<timestamp>_<mode>/report.{json,md,html,sarif}. As a CI gate:

uv run deepscan scan ./my-project --fail-on high   # exit 1 on any HIGH-or-above

Run the offline code-graph taint pass on its own:

uv run deepscan scan ./my-project --scanner analysis

Connect an agent by dropping an .mcp.json into the project (server runs at 127.0.0.1:8000):

{
  "mcpServers": {
    "deepscan": {
      "type": "http",
      "url": "http://127.0.0.1:8000/mcp"
    }
  }
}

The agent then calls the same engine over MCP and opens one review branch per fix, each with a test proving the vulnerability is closed.

Caveats

The author is explicit that "deterministic" does not mean "correct" — the wrapped scanners over-report and produce false positives by design; the agentic triage half exists precisely because of that noise. The code-graph engine is described as work-in-progress. No authentication on the MCP/API surface, so keep it bound to localhost.