What it does
DvalinCode, which calls itself Dvalin, is a local-first security tool that sits between code generation and merge. It scans a project with built-in rules for injection, hardcoded secrets, XSS, eval and unsafe shell use, and can add engines such as Semgrep, Trivy, OSV-Scanner and Snyk. The first scan needs no account, model or API key, and no code leaves your machine unless you name an engine that uploads source. Its central idea is that the model that wrote a repair should not be the one judging it. Dvalin re-scans, runs the project's own tests itself and reads the exit codes, then issues a Verified Fix Record, a JSON file that can be re-checked offline with a verify-fix command. The record states what the scan covered, and repairs that only hide a finding, for example by adding a suppression or deleting tests, do not pass. A loop mode keeps re-scanning and handing the executor only what is still wrong until the gate passes or the loop stalls. It works as an MCP server that agents such as Claude Code, Codex and Cursor can call, as a command-line tool, and as a GitHub Action that reports findings on pull request diffs. It can import and export SARIF. An optional fix step uses a model you provide through an OpenAI-compatible endpoint, works in an isolated worktree and opens a draft pull request, never merging automatically.
Capabilities
- Built-in scan for injection, secrets, XSS, eval and unsafe shell use, with optional Semgrep, Trivy, OSV-Scanner and Snyk engines
- Verified Fix Record that can be re-checked offline
- Fix loop that re-scans and runs project checks until clean or stalled
- MCP server for agents in Claude Code, Codex, Cursor and VS Code
- GitHub Action that reports findings on pull request diffs
- SARIF import and output
When to use it
- AI agents write part of your code and you want an independent check that security fixes work
- You want a pull request gate that only flags what a change adds
- You want a local security scan that needs no account or API key
