honeybadger (Famclaw)

蜜獾

AI助手运行时使用的技能、工具和MCP服务器的安全扫描程序。

蜜獾不在乎。HoneyBacker无论如何都会检查。

它的作用

在运行人工智能助手的家庭服务器上安装任何东西之前，HoneyBacker会对其进行检查。 HoneyBacker只执行静态分析——它读取源代码和元数据，但从不执行扫描的代码。

安装

# Go install (requires Go 1.22+)
go install github.com/famclaw/honeybadger/cmd/honeybadger@latest

# Binary download (Linux amd64)
curl -fsSL https://github.com/famclaw/honeybadger/releases/latest/download/honeybadger-linux-amd64 \
  -o honeybadger && chmod +x honeybadger

# Docker
docker pull ghcr.io/famclaw/honeybadger:latest

所有平台： 发布 — Linux（amd64、arm64、armv7）、macOS（arm64、amd64）。 验证下载：请参阅 安全.md.

用法

命令行界面

honeybadger scan  [flags]

Flags:
  --paranoia string      off|minimal|family|strict|paranoid (default: family)
  --format string        ndjson|text (default: ndjson)
  --llm string           LLM endpoint override
  --db string            Path to audit trail file
  --installed-sha string SHA256 of installed version
  --installed-tool-hash  SHA256 of installed MCP tool definitions
  --tool-manifest string  Path to MCP tools/list JSON for tool-definition analysis
  --tool-baseline string  Path to approved tools/list JSON for rug-pull diffing
  --force                Skip scan, exit 0
  --offline              Skip network calls, scan local only
  --path string          Subdirectory within repo to scan

MCP服务器

honeybadger --mcp-server

通过stdio与MCP JSON-RPC对话。暴露 honeybadger_scan 工具。

管道输入

cat SKILL.md | honeybadger scan -

从stdin读取并将其作为单个文件进行扫描(SKILL.md 默认情况下）。 输入上限为10MB。

抑制发现

地点a .honeybadgerignore 存储库根目录中的文件。每条线都抑制 按规则ID查找结果，可选地受全局模式或代码段SHA256约束：

# Suppress all findings for a rule
SECRET_IN_CODE

# Suppress only in test fixtures
SECRET_IN_CODE *.test.yaml

# Suppress a specific snippet by SHA256
SECRET_IN_CODE sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

被压制的发现被排除在判决之外。A. suppression_summary 当发现被抑制时，会发出NDJSON事件。在文本模式下，摘要 这句话印在判决书之后。

它检查什么

为什么选择HoneyBacker

HoneyBacker从调用者提供的清单中分析MCP工具定义，并且从不执行服务器，这与调用 tools/list 在实时服务器上。

|| HoneyBacker |思科MCP扫描仪| Snyk代理扫描|邻近性| |---|:-:|:-:|:-:|:-:| | 单个二进制 |Go | Python | Python | Python| | 脱机模式 |是|部分（静态）|否|部分（局部Ollama）| | MCP服务器模式 |是（JSON-RPC）|扫描MCP服务器| | 偏执水平 |5层|否|否| | SKILL.md扫描 |是|否|是|是| | CVE扫描 |8种锁文件格式|否|否| | 秘密检测 |gitleaks 800+|Yara|是（技能模式）|是（技术扫描）| | 供应链 |是|否|否|不| | 证明 |是|否|否|不| | 无云依赖 |是|部分|否（需要斯奈克API）|部分（Ollama ok）| | 在ARM/RPi上运行 |是|否|否|不| | 审计跟踪 |JSONL |否|否|

集成

偏执水平

输出

换行符分隔的JSON流式传输到stdout。事件：进展、发现、cve、健康、认证、沙盒、抑制_总结、结果。

结果包括可用的规则元数据： rule_id, more_info_url，以及 references 根据源YAML规则。 在文本模式下，严重性标签显示 [SEVERITY rule_id] 以及a → url 行链接到更多文档。

退出代码：0=通过，1=警告，2=失败，3=错误。

项目结构

honeybadger/
├── cmd/honeybadger/
│   ├── main.go              # CLI entry point — full pipeline wiring
│   ├── mcp.go               # MCP server mode — JSON-RPC over stdio
│   ├── mcp_test.go          # MCP server tests via in-process client
│   ├── integration_test.go  # CLI + MCP integration tests (build tag: integration)
│   └── e2e_test.go          # E2E stdio MCP server subprocess tests
├── internal/
│   ├── engine/
│   │   ├── engine.go        # Verdict computation, tier/sandbox detection, scanner list builder
│   │   └── engine_test.go
│   ├── fetch/
│   │   ├── fetch.go         # Repo type, Route(), Fetcher interface
│   │   ├── fetch_test.go
│   │   ├── github.go        # GitHub fetcher
│   │   ├── gitlab.go        # GitLab fetcher
│   │   ├── stdin.go         # Stdin fetcher (piped input via -)
│   │   ├── stdin_test.go
│   │   └── tarball.go       # Tarball fetcher
│   ├── ignore/
│   │   ├── ignore.go        # .honeybadgerignore parser and finding filter
│   │   └── ignore_test.go
│   ├── report/
│   │   ├── types.go         # Emitter interface
│   │   ├── ndjson.go        # NDJSON streaming emitter
│   │   ├── ndjson_test.go
│   │   ├── text.go          # Human-readable text emitter
│   │   ├── text_test.go
│   │   ├── llm.go           # LLM prompt assembly + verdict calling
│   │   └── llm_test.go
│   ├── scan/
│   │   ├── finding.go       # Finding struct, severity constants, ParanoiaLevel, Options
│   │   ├── finding_test.go
│   │   ├── scan.go          # ScanFunc type, RunAll (concurrent runner with fan-in)
│   │   ├── scan_test.go
│   │   └── helpers.go       # WalkCode, IsPlaceholder, Redact, EditDistance, IsBinaryFile
│   ├── scanner/
│   │   ├── secrets/
│   │   │   ├── secrets.go       # Secrets scanner (gitleaks-powered)
│   │   │   └── secrets_test.go
│   │   ├── supplychain/
│   │   │   ├── supplychain.go   # Supply chain risk patterns + typosquat detection
│   │   │   └── supplychain_test.go
│   │   ├── cve/
│   │   │   ├── cve.go           # CVE scanner via osv.dev API
│   │   │   ├── deps.go          # Dependency parser (8 lockfile formats)
│   │   │   ├── cve_test.go
│   │   │   └── deps_test.go
│   │   ├── meta/
│   │   │   ├── meta.go          # SKILL.md meta scanner
│   │   │   └── meta_test.go
│   │   ├── capability/
│   │   │   ├── capability.go    # Capability drift scanner (requires vs code)
│   │   │   ├── network.go       # Network capability evidence detection
│   │   │   ├── filesystem.go    # Filesystem capability evidence detection
│   │   │   ├── bins.go          # Executable invocation detection
│   │   │   ├── env.go           # Environment variable read detection
│   │   │   └── capability_test.go
│   │   ├── attestation/
│   │   │   ├── attestation.go   # Attestation verification scanner
│   │   │   └── attestation_test.go
│   │   └── mcptool/
│   │       ├── mcptool.go           # MCP tool scanner entry point
│   │       ├── manifest.go          # tools/list JSON loader
│   │       ├── model.go             # MCP tool definition types
│   │       ├── detect.go            # Top-level detection dispatcher
│   │       ├── extract.go           # Source-based tool extraction (no manifest)
│   │       ├── textfields.go        # Text field enumeration across tool structs
│   │       ├── injection.go         # Prompt-injection pattern detection
│   │       ├── unicode.go           # Zero-width / homoglyph / RTL / Tags-block detection
│   │       ├── shadowing.go         # Cross-tool shadowing detection
│   │       ├── capability.go        # readOnlyHint vs params/source mismatch detection
│   │       ├── rugpull.go           # Baseline diff / rug-pull detection
│   │       ├── mcptool_test.go
│   │       ├── manifest_test.go
│   │       ├── detect_test.go
│   │       ├── extract_test.go
│   │       ├── textfields_test.go
│   │       ├── injection_test.go
│   │       ├── unicode_test.go
│   │       ├── shadowing_test.go
│   │       ├── capability_test.go
│   │       ├── rugpull_test.go
│   │       └── integration_test.go
│   ├── store/
│   │   ├── audit.go          # JSONL audit trail writer
│   │   └── audit_test.go
│   └── testfixture/
│       ├── fixtures.go       # Builder functions returning *fetch.Repo with in-memory files
│       ├── fixtures_test.go  # Smoke tests for all fixtures
│       └── mock_osv.go       # Mock osv.dev server for testing CVE scanner
├── rules/
│   ├── supplychain/               # Supply-chain detection YAML rules
│   ├── skillsafety/               # Skill-safety detection YAML rules
│   └── mcptool/
│       ├── concealment.yaml       # Concealment / obfuscation prompt-injection patterns
│       ├── threat-framing.yaml    # Threat-framing prompt-injection patterns
│       └── silent-redirect.yaml   # Silent-redirect prompt-injection patterns
├── .github/
│   ├── dependabot.yml
│   └── workflows/
│       ├── ci.yml
│       ├── codeql.yml
│       └── release.yml
├── docs/
│   ├── INSTALLATION.md       # Installation guide for all runtimes
│   ├── CLAUDE_CODE.md        # Claude Code integration guide (MCP config, hooks)
│   ├── EXAMPLES.md           # CLI and MCP usage examples
│   └── docs_test.go          # Doc validation tests (11 functions, 35 checks)
├── .gitignore
├── .goreleaser.yml           # GoReleaser config: builds, signing, Docker, SBOM, changelog
├── Dockerfile                # Multi-stage distroless image (local dev)
├── Dockerfile.goreleaser     # GoReleaser Docker image (pre-built binary)
├── go.mod
├── go.sum
├── Makefile
├── README.md
├── SECURITY.md
└── SKILL.md                  # AgentSkills manifest for skill registries

状态

v0.5.0发布 -- 下载二进制文件

八种扫描仪：机密、简历、供应链、元、能力、技能安全、， 证明，mcptool。这 mcptool scanner分析MCP工具定义 中毒、交叉工具阴影、能力不匹配和地毯漂移。 检测规则由YAML定义，运行时可扩展。与签署的二进制文件 Sigstore联名，SPDX SBOM附在每个版本上。

看 更改日志.md 版本历史。

建筑

make build              # current platform
make cross              # all 5 targets (linux arm64/armv7/amd64, darwin arm64/amd64)
make test               # run all tests
make self-check         # scan ourselves at strict paranoia (requires prior release)
make self-check-bootstrap  # scan at minimal paranoia (for initial releases only)
make release-dry        # test GoReleaser locally (snapshot, no publish)

使用自定义规则进行扩展

检测规则是嵌入在二进制文件中的YAML文件。在以下位置添加自定义规则 运行时通过丢弃 .yaml 文件进入 ~/.honeybadger/rules/ （或设置 HONEYBADGER_RULES_DIR):

mkdir -p ~/.honeybadger/rules/custom
cat > ~/.honeybadger/rules/custom/my-rule.yaml << 'EOF'
id: my_custom_check
kind: pattern
scanner: supplychain
category: custom
severity: HIGH
signal: file_content
patterns:
  - regex: 'SOME_DANGEROUS_PATTERN'
    description: "My custom detection"
message: "Custom rule matched"
EOF
honeybadger scan ./my-project  # custom rule will fire

看 rules/README.md 对于完整格式规范。

发布检查表

1. make self-check 通过严格偏执（或 self-check-bootstrap 首次发布）
2. 标签： git tag vX.Y.Z && git push origin vX.Y.Z
3. GoReleaser通过以下方式构建、签署和发布 .github/workflows/release.yml
4. 验证版本：请参阅 安全.md
5. 设置GitHub主题： security, mcp, supply-chain, scanner, agentskills, golang

许可证

麻省理工学院