hlsitechio/Shellockolm-AI-CLI-MCP-Scanner

⚡ Install & Run in 60 Seconds

iex (irm https://raw.githubusercontent.com/hlsitechio/shellockolm/main/scripts/install.ps1)

curl -fsSL https://raw.githubusercontent.com/hlsitechio/shellockolm/main/scripts/install-debian.sh | bash

curl -fsSL https://raw.githubusercontent.com/hlsitechio/shellockolm/main/scripts/install-arch.sh | bash

curl -fsSL https://raw.githubusercontent.com/hlsitechio/shellockolm/main/scripts/install.sh | bash

Then run: python src/cli.py scan . → ✅ Instant security audit

🤖 Want AI integration? python src/configure_mcp.py → Use Shellockolm inside Claude/Copilot!

🚨 Why This Exists

I scanned 15 React apps. Every single one was vulnerable.

💀 What I Found (In 2 Minutes):

• 🔴 Remote Code Execution → React Server Components CVE-2025-55182
• 🔴 Middleware Bypass → Next.js authentication broken
• ☠️ Malware → Hidden in npm packages I trusted
• 🔑 API Keys Exposed → Sitting in .env files, pushed to Git
• 🦠 Supply Chain Attack → Dependencies were compromised

⏱️ Manual Audit = 3 Days. This Tool = 2 Minutes.

If you're shipping React/Next.js to production without scanning, you're playing Russian roulette with your users' data.

🎯 What It Finds

Tracks 32 unique CVEs across React, Next.js, Node.js, npm, n8n, and supply chain attacks.

🎬 See It In Action

Interactive Shell

┌─────────────────────────────────────────────────────────────┐
│  Shellockolm - Security Detective v1.0                      │
├─────────────────────────────────────────────────────────────┤
│  1   Full Scan           → All 7 scanners, 32 CVEs          │
│  2   React Scanner       → Server Components RCE            │
│  3   Next.js Scanner     → Middleware bypass                │
│  17  Deep Malware Scan   → RCE payloads, cryptominers       │
│  23  Scan for Secrets    → 50+ patterns, high entropy       │
│  X   QuickFix            → Auto-patch all vulnerabilities   │
└─────────────────────────────────────────────────────────────┘

CLI One-Liners

# Full security audit
python src/cli.py scan .

# Scan before installing npm package
python src/cli.py scan --scanner npm ./suspicious-package

# Export to JSON for CI/CD
python src/cli.py scan . -o security-report.json

# Live probe a URL for exploits
python src/cli.py live https://target.com

# Hunt for a specific CVE
python src/cli.py info CVE-2025-55182

💡 Why Shellockolm?

🛠️ Complete Features

# GitHub Actions
- name: Security Scan
  run: |
    pip install -r requirements.txt
    python src/cli.py scan . -o results.json

📖 Common Use Cases

🔍 Audit your React/Next.js app

python src/cli.py scan ~/my-nextjs-app --scanner nextjs

🛡️ Check before npm install

# Sandbox install + scan in temp directory
python src/cli.py shell
> 1b  # Pre-Download Check
> suspicious-package-name

🚨 Hunt for a specific CVE

python src/cli.py shell
> 1d  # CVE Hunter
> CVE-2025-29927
> /path/to/project

🤖 Live probe for exploits

python src/cli.py live https://target.com --scanner n8n

📊 Generate security report

python src/cli.py scan . -o report.json
python src/cli.py shell
> 37  # Export SARIF for GitHub Code Scanning

🎓 Why Python for a JavaScript Security Tool?

Shellockolm scans JavaScript projects from the outside — it doesn't execute your code, it inspects it.

• ✅ No conflict with target - No shared dependencies, no node_modules pollution
• ✅ No supply chain risk to scanner - Zero npm dependencies = zero attack surface
• ✅ Cross-platform with no build - Works on Windows/Linux/macOS with pip install
• ✅ Rich CLI out of box - Beautiful tables, progress bars, colored output
• ✅ Fast enough - Static analysis doesn't need V8's JIT

The scanner sits outside the blast radius of the ecosystem it's auditing.

🔒 Privacy & Security

• 100% Local — All scans run on your machine
• No Upload — Your code never leaves your system
• No Telemetry — Zero data collection
• No API Keys — Works completely offline
• Open Source — Full transparency (MIT License)

📚 Complete Command Reference

📊 Tracked CVEs

🤝 Contributing

Found a bug? Have a feature request? Want to add CVE coverage?

• Issues
• Discussions

📝 License

MIT License — See

📚 More Documentation: