# Bastion

> Local security scanner for web apps. 15 checks, plain-language findings, AI fix prompts. Runs entirely on your machine, your code never leaves.

- **Type:** MCP server
- **Install:** `agentstack add mcp-absastreon-bastion`
- **Verified:** Pending review
- **Seller:** [absastreon](https://agentstack.voostack.com/s/absastreon)
- **Installs:** 0
- **Category:** [Databases](https://agentstack.voostack.com/c/databases)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [absastreon](https://github.com/absastreon)
- **Source:** https://github.com/absastreon/bastion
- **Website:** https://bastion.wiki

## Install

```sh
agentstack add mcp-absastreon-bastion
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

BASTION
  Security scanner for Cursor-generated code. Runs locally. Explains what it finds.

  
  
  

---

## What is this

Bastion scans your code for security issues and tells you how to fix them. It runs on your machine, never uploads your code, and works with any Node.js project.

Cursor (and other AI coding tools) help you build fast, but they regularly ship hardcoded secrets, missing headers, and injection vectors. Enterprise scanners cost £300+/mo and drown you in jargon. Bastion is the middle ground: it catches the stuff that actually matters and explains it in plain English.

Every finding comes with a prompt you can paste into Claude, ChatGPT, or Copilot to get a fix tailored to your stack.

---

## Quick Start

```bash
# Scan your project (no install required)
npx bastion-scan scan

# Scan a live URL (headers, SSL, security.txt)
npx bastion-scan scan --url https://yourapp.com

# JSON output for CI/CD
npx bastion-scan scan --format json

# Generate security configs for your stack
npx bastion-scan scan --generate-configs
```

If you run scans frequently, install globally:

```bash
npm install -g bastion-scan
bastion scan
```

---

## Tuned for Cursor users

Bastion includes detection rules tuned for patterns that Cursor's AI tends to produce: env vars exposed in client components, missing helmet middleware, Supabase service role keys leaked client-side, placeholder auth that looks real but verifies nothing. Other scanners use generic OWASP rules. Bastion knows what Cursor writes.

Works with Lovable, Replit, Bolt, v0, and any other AI coding tool too — the checks are universal.

### Cursor users: add this to `.cursorignore` first

`.gitignore` stops secrets from being committed, but Cursor's codebase indexer still reads `.gitignore`d files by default. Add a `.cursorignore` file to prevent Cursor from ever seeing your secrets:

```
.env
.env.*
*.pem
*.key
secrets/
```

This single step prevents your keys from leaking into Cursor's context window — and into any AI-generated code that references them.

---

## What it checks

| Check | What it does |
|-------|-------------|
| `.gitignore` coverage | Makes sure `.env`, `node_modules`, and keys are excluded |
| Hardcoded secrets | API keys from OpenAI, Anthropic, GitHub, Stripe, AWS, Google, Slack, and more |
| Dependency audit | Wraps `npm audit` and maps findings to severity levels |
| `.env.example` | Checks that a template exists with safe placeholder values |
| `security.txt` | Validates RFC 9116 Contact + Expires fields |
| Security headers | CSP, HSTS, X-Frame-Options, Referrer-Policy, and more |
| SSL/TLS | HTTPS redirect, cert validity, TLS version |
| Insecure code patterns | `eval()`, `innerHTML`, SQL concatenation, `exec()` |
| CORS config | Catches `Allow-Origin: *`, bare `cors()`, credential leaks |
| Rate limiting | Looks for `express-rate-limit`, `@upstash/ratelimit`, etc. |
| Auth method | Flags hand-rolled auth, suggests Clerk/Supabase/NextAuth |
| `security.txt` URL | Fetches and validates the remote file |
| Cookie security | Checks `Set-Cookie` flags: `HttpOnly`, `Secure`, `SameSite` |
| Server disclosure | Flags `Server` headers that leak software versions |
| DMARC record | Verifies email authentication policy via DNS |

### Stack detection

Bastion figures out what you're running. It detects **Next.js, Express, Fastify, Remix, Astro, Nuxt, SvelteKit, Hono**, plus databases, auth providers, hosting, and package managers. AI prompts and config suggestions are tailored to your stack.

### Output formats

Three options: **terminal** (colour-coded, score ring, verbose mode), **JSON** (for CI/CD), and **markdown** (writes a `security-report.md`).

### Config generators

Bastion can output ready-to-paste configs for your stack:

- `helmet.js` setup for Express/Fastify
- CORS policy
- Rate limiter middleware
- Next.js security headers
- `.gitignore` additions

### security.txt generator

Interactive CLI that walks you through creating a valid RFC 9116 `security.txt`:

```bash
npx bastion-scan generate security-txt
```

---

## CLI Usage

```
bastion scan [options]

Options:
  -p, --path           Project path (default: current directory)
  -f, --format        Output format: terminal, json, markdown
  -u, --url            Live URL to scan (headers, SSL, security.txt)
  -v, --verbose             Show fix instructions and AI prompts
  --generate-configs        Print security config snippets for your stack
  --output-dir         Write config files to directory
```

---

## Web App

The web dashboard lives at [bastion.wiki](https://bastion.wiki).

- **Security Checklist** with 20 interactive items and fix panels
- **OWASP 2025** guide, all 10 categories in plain language
- **URL Scanner** for quick header/SSL/security.txt checks
- **Vulnerability Feed** with current threats and AI coding risks
- **Tool Recommendations**, 14 curated tools with pricing info
- **Stack Checklists** generated for your framework + database + auth combo
- **Deploy Gate** that runs checks and gives a go/no-go verdict
- **Security Badge** you can embed in your README

---

## Pricing

| | Free | Pro | Team |
|---|---|---|---|
| **Price** | £0 | £19/mo or £179/yr | £49/mo or £469/yr |
| URL scans | Unlimited | Unlimited | Unlimited |
| Security badge | — | Yes | Yes |
| Compliance reports | — | — | Yes |

Annual plans save 2 months.

---

## Security Badge

Drop this in your README to show your score:

```markdown

```

The shield is green at 80+, yellow at 50+, red below 50. It updates when you re-scan.

---

## GitHub Action

Add this to your CI and Bastion will scan every PR:

```yaml
name: Security Scan
on: [pull_request]

jobs:
  bastion:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: absastreon/bastion-action@v1
        with:
          path: '.'
          fail-on: 'critical'    # Block PRs with critical findings
          format: 'markdown'     # Comment results on PR
```

---

## Scoring

You start at **100**. Points come off by severity:

| Severity | Deduction |
|----------|-----------|
| Critical | -15 |
| High | -10 |
| Medium | -5 |
| Low | -2 |

Floor is 0. Only `fail` results deduct. `warn`, `skip`, and `pass` don't affect the score.

---

## Project Structure

```
bastion/
├── packages/
│   ├── cli/          # npx bastion-scan scan: security checks and reporters
│   ├── shared/       # Types, checklist data, OWASP data, tools
│   └── web/          # Next.js dashboard
└── docs/playbooks/   # Stack-specific security guides
```

---

## Contributing

PRs are welcome.

1. Fork the repo
2. Create a feature branch (`git checkout -b feature/amazing-check`)
3. Write tests (Vitest, 80%+ coverage required)
4. Run `npm run build && npm run lint && npm run test`
5. Open a PR against `main`

See [SECURITY.md](SECURITY.md) for vulnerability reporting.

---

## License

MIT. See [LICENSE](LICENSE).

---

## Links

- [Web Dashboard](https://bastion.wiki)
- [CLI Docs](https://bastion.wiki/docs)
- [Stack Playbooks](docs/playbooks/)
- [OWASP Top 10 2025](https://owasp.org/Top10/2025/)
- [Report a Bug](https://github.com/absastreon/bastion/issues)

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [absastreon](https://github.com/absastreon)
- **Source:** [absastreon/bastion](https://github.com/absastreon/bastion)
- **License:** MIT
- **Homepage:** https://bastion.wiki

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** yes
- **Dynamic code execution:** yes

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: flagged — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-absastreon-bastion
- Seller: https://agentstack.voostack.com/s/absastreon
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.