Blog
AI application security, supply-chain provenance, scanner internals, and weekly findings from scanning popular open-source LLM SDKs.
May 9, 2026
We pointed Nox at anthropic-cookbook. It returned 1,950,121 findings. Almost all of them are wrong. Here is what that taught us about RAG-corpus false positives, the literal_eval / eval distinction, and how a real CLAUDE-uses-MCP fixture trips the AI-004 rule.
May 9, 2026
v0.9.0 ships cluster-vs-IaC drift detection, JSON-backed triage history for AI-assisted review, a strict PR gate for high/critical findings, and a marketplace action that opens dependency-remediation PRs.
May 5, 2026
AI-PI, AI-EMB, AI-AGENT, MCP-* — what they catch, why every other scanner misses them, and how the AIBOM ties it all together.
May 4, 2026
We ran Nox against modelcontextprotocol/python-sdk plus 6 other popular LLM/agent repos. Here's what AI-aware scanning catches in 2 seconds — across all 7.
May 3, 2026
Open-source, AI-native security scanner with a cosign-signed plugin marketplace. 19 verified plugins, 717 rules, MCP-native. No SaaS, no telemetry, no source upload.
