cosai-oasis/project-codeguard

Project CodeGuard is an open-source, model-agnostic security framework that embeds secure-by-default practices into AI coding agent workflows. It provides comprehensive security rules that guide AI assistants to generate more secure code automatically.

What it solves

Project CodeGuard addresses the risk of AI coding agents introducing security vulnerabilities—such as hardcoded secrets, weak cryptography, or missing input validation—into software by embedding secure-by-default practices directly into the AI's generation and review workflows.

How it works

It provides a model-agnostic framework of security skills and rules written in a unified markdown format. These are translated into formats compatible with popular coding agents (like Cursor, GitHub Copilot, and Claude Code) and can be integrated into the planning, generation, and review phases of the coding lifecycle. Additionally, it includes an MCP server that allows organizations to centrally manage and stream these security rules to developers' AI assistants via HTTP.

Who it’s for

Software engineers and organizations using AI coding agents who want to ensure their generated code adheres to industry security standards without requiring manual intervention from the developer.

Highlights

  • Broad Security Coverage: Covers domains including cryptography, input validation, authentication, authorization, supply chain, cloud, platform, and data protection.
  • Model Agnostic: Works across various AI coding assistants and IDEs.
  • Centrally Managed: Offers an MCP server for organization-wide deployment of security rules.
  • Lifecycle Integration: Supports security steering during the design, generation, and review phases.

Related

  • Project
    tech-leads-club/agent-skills

    A secure, validated skill registry and CLI for extending AI coding agents with verified, safe, and tested capabilities.

  • Project
    XiNian-dada/Fuck_My_Shit_Mountain

    A codebase auditing skill for AI coding agents that provides structured, evidence-based reports across 25 dimensions including security, stability, and AI safety.

  • Project
    affaan-m/agentshield

    A security auditor for AI agent configurations that scans Claude Code setups for secrets, permission misconfigurations, and prompt injection vectors.

  • Project
    Aaronontheweb/dotnet-skills

    A library of 30 skills and 5 specialized agents for AI coding assistants to ensure .NET development follows production-tested patterns and best practices.

  • Project
    addyosmani/agent-skills

    Agent Skills is a library of 25 Markdown‑based engineering workflows (spec, plan, build, test, review, ship, etc.) that can be installed into many AI coding agents via a simple CLI. It provides slash commands, auto‑build mode, specialist personas, and reference checklists to make AI‑generated code follow senior‑engineer best practices across the entire development lifecycle.