See what your code actually does.
Test any public GitHub repo — an MCP server, an npm package, an AI skill. See auth coverage, risk paths, and dependency signals before you install or integrate.
See real results
Each demo is a real repo. Pick one, see what Shoulder catches.
SQL injection in one line
A dev replaces a parameterized query with string concatenation. Shoulder flags it instantly.
→AI proxy with no guardrails
Hardcoded API key, user-controlled URL, no rate limiting — three findings from one shortcut.
→Vulnerable API — full posture
SQLi, missing auth, no rate limiting, credential exposure. Everything wrong with this API in one scan.
→Malicious dependency
Not a code bug — a supply chain attack. Shoulder catches what SAST tools miss.
→What you'll see
Trust profile
Auth coverage, public vs. protected routes, and where trust breaks down.
Attack paths
Confirmed paths from user input to dangerous execution — SQL, shell, eval, deserialization.
Ecosystem signals
Dependency risk, maintainer trust, and suspicious package patterns.
Want to scan your own projects? Install the CLI — it runs locally and your source code never leaves your machine.
npm install -g @shoulderdev/cli