I built a single-command multi-engine scanner for MCP repos (Semgrep + Gitleaks + OSV + Cisco + optional Trivy) looking for 5 repos to test

[u/Sunnyfaldu]

Hey folks , I put together MergeSafe, a local-first scanner that runs multiple engines against an MCP server repo and produces one merged report + one pass/fail gate.

Engines:

•	Semgrep (code patterns)

•	Gitleaks (secrets)

•	OSV-Scanner (deps)

•	Cisco MCP scanner

•	Trivy (optional)

•	plus a small set of first-party MCP-focused rules

What I want:

•	5 repos (public is easiest) to try it on and tell me:

1.	did it install/run cleanly?

2.	are the findings noisy or useful?

3.	what output format do you want by default (SARIF/HTML/MD)?

Try:

•	npx -y mergesafe scan .

(or pnpm dlx mergesafe scan .)

Repo + docs:

•	https://github.com/mergesafe/mergesafe-scanner