New Kandev plugin: Kandev Security

[meanderix]

Hello,

Kandev Security is my latest contribution to the Kandev ecosystem. It brings scanner reports and agent-generated security findings into a shared, workspace-owned view.

You can import reports in SARIF format and browse findings across multiple scanners, filtering by language, scanner tool, rule, severity and review status. Recurring findings can be grouped across reports while preserving their original evidence and source references.

The plugin also provides MCP tools that let agents browse findings and submit their own reports, one finding at a time. This is useful for tasks such as asking a local LLM to audit application logs or investigate code without having to assemble a SARIF document itself.

Each finding has a Start task menu with workspace-shared presets for investigation, remediation and regression coverage. These open Kandev’s native task dialog with the finding’s evidence already included, and the resulting task stays linked to the issue.

There is also a separate advisory view for exploring related vulnerability identifiers across scanners. For continuously collected reports, you can archive older results, pin reports worth keeping, or configure per-scanner retention limits based on report count and age. CI jobs can submit reports directly through a token-authenticated upload webhook.

I’d welcome feedback, particularly from anyone using different SARIF-producing scanners or experimenting with agent-driven security audits. I’m interested in how well the imported evidence supports your investigation workflow and where it could be improved.

Please check it out:
https://github.com/meanderix/kandev-security

[carlosflorencio]

Awesome @meanderix , thanks for sharing.

Adding it to the registry: #4993

[antropos17]

One import case worth covering: the SARIF path still exists, but the file changed after the scanner ran. I'd keep the original finding and mark its match to the current checkout as stale or unverified. I maintain AEGIS; our external-report importer keeps imported claims distinct from a fresh local review.

Drafted with AI assistance.