falcoraxyz/mincode-vuln-arch — explained in plain English
Analysis updated 2026-05-18
Scan a codebase for security vulnerabilities and get a graded, CWE-tagged audit report.
Scaffold a new minimal Python project with tests and documentation already structured.
Run the toolkit as an MCP server so an AI coding assistant can audit code directly.
| falcoraxyz/mincode-vuln-arch | 0xallam/my-recipe | 0xhassaan/nn-from-scratch | |
|---|---|---|---|
| Stars | 0 | — | 0 |
| Language | Python | Python | Python |
| Last pushed | — | 2022-11-22 | — |
| Maintenance | — | Dormant | — |
| Setup difficulty | easy | moderate | moderate |
| Complexity | 3/5 | 2/5 | 4/5 |
| Audience | developer | general | developer |
Figures from each repo's GitHub metadata at analysis time.
Runs with zero third-party dependencies, optional bandit, pip-audit, or an LLM key deepen coverage.
mincode-vuln-arch is a Python toolkit built to help write small, clean codebases, check them for security problems, and remember what it finds over time, without needing any third party libraries installed to run its core features. The goal stated in the project is to ship the least code needed for a task while keeping things modular and reviewed for safety. It bundles several tools together. One scaffolds a new minimal project structure with source, test, and documentation folders and automatically sets up version control. Another scans a project for security vulnerabilities, tagging findings with standard vulnerability classification codes, assigning a letter grade to the codebase, and optionally checking third party dependencies for known issues. A third tool can look at an existing repository, written by a person or generated by AI, and extract clean, reusable patterns from its structure. There is also a test generator that reads a function's type information and produces basic automated tests for it. A distinctive feature is what the project calls a hash chain vault: a local, tamper evident record of audit findings and notes, signed so that past entries cannot be silently altered without detection, with no data sent over a network. This can optionally integrate with Obsidian, a personal note taking app, to browse findings as linked notes. The toolkit is designed to be used in several different ways depending on preference: as a command line tool after cloning the repository, as a pip installable package, as a single self contained file that runs on any compatible Python version, as a server following the Model Context Protocol so AI coding assistants like Claude Desktop or Cursor can call it directly, or as a drop in skill for AI agent frameworks. An optional connection to a language model can add a deeper logic flaw review on top of the standard checks, and this step is simply skipped if no such connection is configured. The project is released under the Apache 2.0 license.
A zero-dependency Python toolkit that scaffolds minimal projects, audits code for security vulnerabilities, and keeps a tamper-evident record of findings.
Mainly Python. The stack also includes Python, MCP, Obsidian.
Apache 2.0 license: use freely for any purpose, including commercial use, as long as you keep the copyright and license notice.
Setup difficulty is rated easy, with roughly 5min to a first successful run.
Mainly developer.
This repo across BitVibe Labs
double-check against the repo, no cap.