What is Linmas?
Linmas is a defensive security toolkit built specifically for AI-assisted software development. When developers and teams use AI coding agents to write features, refactor code, or deploy infrastructure, Linmas provides structured, expert-level security reviews to catch vulnerabilities, improper access controls, and cloud misconfigurations before changes reach production.
Who is Linmas for?
- Vibe coders & solo developers: Ship ambitious projects with confidence without needing years of AppSec experience.
- Engineering teams: Integrate consistent security checklists and evidence into code review workflows.
- Security practitioners: Scale defensive guidance across AI coding agents with deterministic policy rules.
System Requirements
- Runtime: Node.js 24+ (required for the CLI and local MCP server).
- Git: Required for source checkouts and Codex marketplace installation.
- AI Agent Host: Supported hosts include Codex (primary/native), Claude Code (verified compatible), and any coding agent supporting portable Markdown instructions.
Supported Hosts
| Host | Support Level | Capabilities |
|---|---|---|
| Codex | Primary / Native | Marketplace plugin, 11 skills, 7 MCP tools, provider-backed review engine |
| Claude Code | Verified Compatible | Managed skills directory, CLI integration, Claude API review path |
| Other AI Agents | Portable | Manual import of canonical skills/*/SKILL.md instructions |
Your First Review Path
The fastest way to test Linmas locally without calling external models or configuring API keys is the offline judge demo:
git clone https://github.com/TanKimGwan/linmas.git
cd linmas
npm ci
npm run demo:judgeThe demo evaluates a synthetic code diff, passes it through the baseline-appsec policy, and produces an in-memory Review Capsule demonstrating the exact output format.