Read each change
with the code around it.
Goosy reads the changed lines and the code that calls them. Deep Scan covers the whole repository on demand or on a daily schedule.
Code security
that shows its work.
Goosy reviews every pull request and scans your whole repository for vulnerabilities and bugs. Every finding points to the exact lines and explains why it matters.
Works with GitHub, GitLab and MCP clients such as Claude Code, Cursor and VS Code
HOW IT WORKS
Connect a repo once.
Goosy reviews every pull request.
Four steps, from a connected repo to a fix you approve.
Less noise reaches you, and every finding explains itself.
Read each change
Two checks,
one report.
Rule-based analysis and an AI review both read every change. Goosy merges them and removes duplicates.
If it can't be reached,
you don't hear about it.
Goosy checks whether flagged code can be reached from an entry point. Findings it can show are unreachable never make the report.
Fixes you approve.
Fixes arrive as patches you can review. Apply one, or use Fix all on a pull request. Auto-push stays off until you turn it on for a repo.
BUILT FOR PRODUCTION
Background scans
Scans run as background jobs. You get a scan ID straight away and can check progress at any time.
Scoped, revocable access
GitHub access is scoped per organization through the Goosy GitHub App. API and MCP tokens can expire, and you can revoke them at any time.
■ SURFACES
Your team already has a workflow.
Goosy works inside it.
Connect a repo once. The CLI and MCP server check your code before you push. The dashboard shows results for the whole team.
Every pull request, reviewed as you push.
Goosy reads each change along with the code around it. It posts a summary and inline comments on changed lines. Fixes arrive as diffs you approve.
installgithub.com/apps/goosy-prod-bot
Scan from your terminal before you push.
Scan your code before you push, or run the scan in CI. Set a minimum severity and the command exits non-zero when a finding meets it.
$ npm install -g @goosyai/goosy
Your coding agent can scan the code it writes.
Goosy runs as an MCP server. Clients such as Claude Code, Cursor and VS Code scan the code the agent writes and get findings and fix diffs back.
$ claude mcp add goosy -- npx -y goosy-mcp
Every finding, in one place.
See open findings and past scans for every connected repo, in one view.
Open dashboard →
Every change ships
through one path.
Plan, code, test, review, merge, deploy. Every change must pass
review before it merges.
WHAT WE CATCH
Findings grouped by how code fails.
Each one shows its work.
Rule-based analysis and an AI review both read your code.
Two checks, one report. Goosy removes duplicates and explains every finding.
Untrusted input that reaches
somewhere it should never reach.
Anything a caller controls, from a query param to an uploaded file,
traced to the point where the app uses it.
SQL injectionNoSQL injectionCommand injectionRemote code executionTemplate injectionXML external entitiesCross-site scriptingPath traversalServer-side request forgeryInsecure deserializationUnsafe file uploadCatastrophic regex backtrackingMissing input validation
HOW GOOSY CHECKS
Deep Scan has a dedicated SQL injection detector. Candidates are cross-checked before they reach you.
Access checks that let the wrong user in.
Tests pass, because the code works exactly as written for
a user who should never have been allowed in.
Broken access controlInsecure direct object referenceMissing authorization checkCross-site request forgeryMass assignmentWeak token verificationSessions that never expireClickjackingOpen redirect
HOW GOOSY CHECKS
Goosy reads the callers of changed code, so it can see whether a check runs before the sensitive call.
Credentials in the open, and crypto
that only looks strong.
Keys committed to source, passwords hashed with a broken algorithm,
randomness anyone can predict.
Hardcoded credentialsBroken cryptographic algorithmsWeak password hashingPredictable randomnessSecrets stored in the clearUnencrypted transport
WHY IT MATTERS
Deleting the line leaves the key in git history. Rotate the key.
Small settings that widen the damage
from an attack.
Each one is minor on its own.
Together they turn an incident into a breach.
Sensitive data in error responsesSecrets written to logsVerbose stack tracesDebug mode left onPermissive CORSUnsafe cookie flagsMissing rate limitingDeprecated unsafe APIs
HOW GOOSY CHECKS
Each finding names the exact lines and explains the impact.
The bug that only occurs when two
things happen at once.
Races, leaks and memory faults. They often survive code review, because
they depend on timing or on code outside the diff.
Race conditionsTime-of-check to time-of-useNull dereferenceUse after freeDouble freeBuffer overflowInteger overflowInfinite recursionInfinite loopsMemory leaksResource leaksOff-by-one errorsMissing await
HOW GOOSY CHECKS
Goosy looks for the exact order of operations that triggers each race.
Code that runs fine, and is still wrong.
Logic that looks right line by line, but lets a request skip a check,
run steps out of order, or reach data it should not see.
Ownership checks that can be skippedAuthorization bypassed by workflow orderFields a client should never setData exposed beyond its audienceTiming gaps between check and action
HOW GOOSY CHECKS
Goosy reports logic bugs in their own category, apart from security findings.