Husk
A local-first security scanner that checks your machine for compromised packages, leaked secrets, and risky AI/MCP configs, no cloud, no login.
🔗 Visit Husk
Description
Every time you install a package for a coding project, you're trusting that its code isn't secretly malicious, and every so often, a popular package does get hijacked and starts stealing secrets or crypto wallets from developers' machines. Husk is a tool that scans your computer for exactly this kind of risk: bad packages, leaked API keys sitting in files, sketchy install scripts, and now also badly configured AI assistant setups, without ever sending your data anywhere.
Husk performs static analysis across roughly 68 package ecosystems using public vulnerability databases (OSV.dev, npm, PyPI, GitHub Advisories, CISA's Known Exploited Vulnerabilities list), entirely offline with zero network calls and no account required. It's built in Rust, ships a CLI, a terminal UI, and a local web dashboard, and also runs as an MCP server so AI coding agents can query it directly. Policy files let teams define allow/block rules, and releases are Cosign-signed with SLSA provenance attestations.
💬 Our review
The short version: Husk is a solid, free, privacy-respecting scanner for catching supply-chain risk before it lands in your codebase, useful, but it's a young project competing against much larger incumbents.
Snyk and Dependabot both do dependency vulnerability scanning with far bigger vulnerability databases, paid enterprise tiers, and years of coverage; Husk's edge is that it runs 100% locally with zero network calls and zero account, which matters if you're security-conscious about even sending metadata off-machine, and its MCP server integration is a genuinely useful angle for teams wiring AI coding agents into their workflow. At 4 GitHub stars, it's early, worth trying for personal or small-team use where the offline guarantee matters, but don't yet treat it as a replacement for an established scanner in a compliance-driven org.
💰 Pricing
📊 Global score
🤖 AI-enriched data
Gratuit et open-source
Pros
100% local, aucun appel réseau ni compte requis
68 écosystèmes de paquets couverts
détecte aussi les secrets fuités et scripts d'install risqués
releases signées Cosign + provenance SLSA
serveur MCP pour agents IA
Cons
projet jeune (4 stars), peu de retours terrain
base de vulnérabilités moins large que Snyk/Dependabot
pas de tableau de bord cloud pour équipes