Documentation

Quick Start

MEDUSA is an AI-first security scanner with 79 scanners and 40,000+ detection rules. It works out of the box — no external tools, no API keys, no configuration. Install it and run your first scan in under a minute:

pip install medusa-security
medusa scan .

That's it. MEDUSA scans your project for prompt injection, MCP vulnerabilities, RAG poisoning, agent attacks, leaked secrets, and traditional code vulnerabilities, then prints a prioritised report.

Vet a repo before you clone it

Scan any remote GitHub repository for AI supply-chain attacks — including poisoned AI editor configs (.cursorrules, mcp.json, .claude/ hooks and skills) — without cloning it first:

medusa scan --git https://github.com/org/repo
medusa scan --git org/repo          # shorthand

Report formats

Export results as JSON, HTML, SARIF, or Markdown — SARIF plugs straight into GitHub Code Scanning:

medusa scan . --format sarif -o results.sarif

Full Quick Start on GitHub →

Installation

MEDUSA supports Windows, macOS, and Linux on Python 3.9+.

Standard install

pip install medusa-security

Virtual environment (recommended)

python3 -m venv medusa-env
source medusa-env/bin/activate   # Windows: medusa-env\Scripts\activate
pip install medusa-security
medusa scan .

Platform notes

• Windows: use py -m medusa if the medusa command is not found
• macOS / Linux: works out of the box

Optional extras

• AI model scanning: medusa install --ai-tools adds modelscan for ML model vulnerability detection
• External linters: if bandit, eslint, or shellcheck are already installed, MEDUSA auto-detects and uses them to enhance coverage — they are never required

Full Installation Guide on GitHub →