REPOSITORY SCANNING
What each scanner actually looks at
Four tools that all get called security scanners, and that do not read the same files. This page is only about what can be found in a repository before anyone runs anything. Nothing here is about governing a running agent.
Where each one stands
The table
The agent surface committed to the repo
Everything a pull request can change without anyone reading it closely.
| What is being asked | node9 | Snyk | pipelock | Scorecard |
|---|---|---|---|---|
| A workflow that feeds a stranger's text to the agentan issue or PR from an unknown account reaching an agent that holds secrets | ● | ○ | ○ | ◐ |
| Secrets the agent can reach from where it runsa cloud key or an id-token within reach of an agent that has a shell | ● | ○ | ○ | ◐ |
| The list of tools the agent is allowed to callBash(*) and Write(*) sitting in .claude/settings.json | ● | ◐ | ○ | — |
| Hooks that fetch and run remote codean unpinned curl or npx on the agent's hot path | ● | ○ | ○ | — |
| The script the hook points atwe read the command line, not the file it executes | ○ | ○ | ○ | — |
| MCP servers unpinned, or holding a secretnpx @latest, or a token sitting inside .mcp.json | ● | ◐ | ○ | ◐ |
| Instruction files that carry a payloadconcealed characters, or curl piped to a shell, inside CLAUDE.md | ● | ○ | ○ | — |
| Skills, subagents and slash commandscommitted files the agent loads on its own; we do not read them at all | ○ | ● | ○ | — |
What this pull request introduced
The question a reviewer is actually asking, which is not the same as how many problems the repo has.
| What is being asked | node9 | Snyk | pipelock | Scorecard |
|---|---|---|---|---|
| New findings only, measured against the base branchthis PR added one problem, rather than this repo has twelve | ●shipped in 2.12.0 | ○ | ◐secrets only | ○ |
| A secret added in this diffa key pushed in this commit | ◐ | ○ | ● | ○ |
| Findings placed on the source line in the reviewa comment on line 42, not a log to open in another tab | ○ | ● | ○ | ○ |
| A way to suppress a finding you have acceptedthe same warning on every PR until people stop reading them | ○ | ● | ●exemption records | ○ |
The developer's machine
| What is being asked | node9 | Snyk | pipelock | Scorecard |
|---|---|---|---|---|
| Which agents and MCP servers are actually installed herediscovering what is running, rather than what is committed | ● | ● | ● | — |
| Tool descriptions from a live MCP serverinjection in a tool description, shadowing, a change after install | ○ | ● | ● | — |
Engineering hygiene of the repo itself
| What is being asked | node9 | Snyk | pipelock | Scorecard |
|---|---|---|---|---|
| Branch protection, code review, signed releasesa 0 to 10 score for the project as a software project | ○ | ○ | ◐scores its own config | ● |
How to read it
Scorecard is a measuring stick, not a rival
It checks whether a project is maintained properly. The only two of its checks that touch the same files we do are Dangerous-Workflow and Token-Permissions, and neither has any concept of an agent: they cannot tell a build step from an AI agent holding a shell. We measure node9 against it and publish the number.
pipelock does not scan your repository
Their Action runs pipelock audit, which grades how well you configured pipelock: enforcement off, sandbox not enabled, MCP tool scanning disabled. Plus secret scanning on the diff. It does not read your workflows, your .claude/settings.json, or your CLAUDE.md. It is a smart adoption mechanism and a different question.
The two empty rows are the roadmap
The script a hook points at, and the skills and subagents an agent loads by itself, are committed files that execute on the agent's behalf and that nobody in this table reads properly. That is where the next work goes.
Measured 9 September 2026 against each tool's own source and documentation.
The other question is on its own page: What actually stops an agent mid-task.