Every static analysis tool you know shares one quiet assumption: somewhere
between the code being written and the code being merged, a human being
reads it. SAST is a second pair of eyes. It was never meant to be the first
pair.
That assumption is dead. A majority of new code is now AI-generated, and an
increasing share of it ships with no human reading anything. The review
step that every security tool implicitly depends on simply doesn't happen.
The 2026 breach feed is what that looks like in practice: apps with
beautiful UIs and no row-level security. Service-role keys shipped to the
browser. API routes with no auth check at all. Not exotic vulnerabilities;
the classics, at industrial scale, because the generator optimizes for
"works in the demo" and nothing downstream asks "but is it safe?"
What a scanner for this world has to do differently
When I started building Umbra I thought I was writing better rules. The
rules turned out to be the easy part. The interesting differences:
1. It has to verify, not pattern-match. "The app builds" and "the tests
pass" are claims AI repos make constantly and violate routinely. So Umbra
copies the repo into a locked-down Docker container (no network, hard
limits), builds it, boots it, probes it over HTTP, and replays documented
claims against what actually happens. Findings without evidence are how
scanners lose trust; claims without verification are how repos lose it.
2. It has to be deterministic. If a score moves between runs, nobody
puts it in CI. Same repo, same rubric version, same score. Low-confidence
heuristics never move the number; they go to a notes section. A security
tool that cries wolf gets uninstalled, so false-positive reports are
severity-one bugs for us.
3. It has to live where the agent lives. A scanner you run after the
fact catches last week's mistake. So Umbra also runs inline: PreToolUse
hooks (Claude Code, Kimi Code) that review every file the agent writes
before it lands, and an MCP server for agents that call tools. An agent
trying to write a live key into .env gets the write blocked with the
reason fed back, so it fixes the root cause instead of shipping the leak.
(One detail people get wrong: agents don't write files through MCP, so an
MCP proxy can't intercept writes. Hooks can. The MCP server is the
voluntary layer; hooks are the immune system.)
4. It has to respect the human's attention. One score, five findings
with file:line evidence, receipts for claims. Not a 400-line SARIF dump.
The output is designed to be screenshot-legible, because the person
deciding whether to trust the tool gives it about four seconds.
The score
All of this rolls into one number, 0–100, across four axes: SAFE, RUNS,
HONEST, CLEAN. The rubric is versioned and public. A repo caught lying
about its tests caps below passing, no matter how clean everything else is.
cd your-project
npx umbra-scan # fast static scan
npx umbra-scan --deep # + sandbox verification (needs Docker)
MIT licensed, fully local, works offline. Star it if it earns it:
https://github.com/elberacasa/umbra
Top comments (0)