Catch the bug while it is written, not after it ships.

Most security tools run after the fact: you write the code, you commit it, and a scanner tells you weeks later what you broke. IOnclad's AI Co-Pilot flips that. It plugs into the AI assistant you already use through MCP, so the assistant can scan code the moment it is drafted, before it ever hits your disk. It is opt-in, off by default, and your code never leaves your machine. The Co-Pilot is part of IOnclad Pro.

What it actually is

MCP (Model Context Protocol) is the standard way an AI assistant talks to outside tools. IOnclad ships an MCP server, so any MCP client (Claude Desktop, Claude Code, Cursor, Cline, and others) can call IOnclad's scanner directly during a coding session. The assistant gets a small set of tools it can reach for at the right moment.

scan a project dir check_snippet in memory safety_guidance before you write lookup_rule by ID explain_finding with context rescan_file to verify a fix knowledge_pack for the model + advisory fix plans

The point of all this is timing. The same rule packs IOnclad runs in the desktop app run inside your editor loop, so the unsafe pattern gets flagged at the keystroke, not at the postmortem.

Why this changes the math

A finding caught while the AI is still drafting costs a sentence to fix. The same finding caught after launch costs an incident. Here is where the Co-Pilot earns its keep:

1. The snippet check happens before disk

When the assistant is about to write code, it can pass that code to check_snippet. No file is written, the analysis is in-memory, and IOnclad runs the same scanner set against it that a full project scan uses. So the AI sees "this draft has a problem" and rewrites it before the bad version ever lands in your repo. That is the whole game: stop the mistake at the source instead of hunting it down later.

2. Guidance up front, not corrections after

Before writing anything security-sensitive (a Stripe webhook, a file upload, JWT auth, an OpenAI call) the assistant can ask safety_guidance for the cluster of rules that apply and a correct-by-construction template. The AI writes the safe shape on the first pass instead of needing a cleanup round. It also surfaces the launch obligations that feature creates, so they are scaffolded early.

3. A real propose, apply, verify loop

When IOnclad does flag something, the assistant can call explain_finding to pull the exact code window and the rule rationale, propose a concrete fix, and then call rescan_file after you apply it to confirm the finding actually cleared. IOnclad never edits your files. The AI proposes, you apply, IOnclad verifies.

The privacy line, and where it sits

Wiring a scanner into an AI assistant raises an obvious question: what leaves your machine, and what does the model get to see? IOnclad draws that line hard, and it is worth being precise about it.

The rule

The Co-Pilot is off by default. It does nothing until you flip the toggle in IOnclad Settings. There is a master kill switch: when it is off, every MCP tool refuses to process anything, in either direction. And the tools that change state (suppressing a finding, writing a fix plan) need their own separate opt-in, so you can grant read-only help without granting write access.

What a session looks like

Concretely, the flow inside your editor reads like this:

# You ask your assistant to add a Stripe webhook handler.
# Before writing, it asks IOnclad what to watch for:
safety_guidance(intent: "stripe webhook")
  // returns the rule cluster + a safe template

# It drafts the handler, then checks the draft in memory:
check_snippet(language: "typescript", code: "<the draft>")
  // FW70: webhook signature not verified  ← caught before disk

# It rewrites with signature verification, you apply it,
# then it confirms the fix landed:
rescan_file(file: "src/webhooks/stripe.ts")
  // Clean. No findings. Fix verified.

How IOnclad keeps it safe

The Co-Pilot is built around the assumption that an AI model is reading every response, so the scanner guards the boundary on purpose:

Secrets are redacted at the MCP boundary. Every tool response is run through IOnclad's secret redaction before it reaches the model, so a flagged credential is described, not handed over.
Pro-gated, and gated again by a toggle. A Pro license controls access; the Co-Pilot toggle controls the whole feature. Free users hit a paywall response; toggle-off users hit a "disabled" response. Both fail closed.
Mutations are a separate switch. Suppressing a finding needs both Co-Pilot enabled and mutation tools enabled. A short or vague justification gets rejected and becomes a permanent audit-trail entry you can review.
The same rule packs as the desktop scan. Snippet checks and file rescans route through the shared analysis core, so what the AI sees can never quietly drift from what a full scan would catch.
Stateless by design. MCP scans skip the history write, so an in-editor check does not pollute your saved scan history.

IOnclad finds known patterns and common misconfigurations. It is a fast second set of eyes inside your editor, not a guarantee or a full pentest.

How to turn it on

Activate Pro, since the Co-Pilot tools are a Pro feature. Free clients get a paywall response on every call.
Flip the AI Co-Pilot toggle in IOnclad Settings. This is the master switch and it starts off. Until it is on, no data moves through MCP.
Add IOnclad's MCP server to your client config (Claude Desktop, Claude Code, Cursor, Cline, or any MCP host). The tools then appear in that client.
Decide on mutations separately. Leave suppression and fix-plan writing off if you want read-only help, or grant them when you want the assistant to manage findings.
Keep it scoped. Suppressions are per project, so verifying a false positive in one repo never silences the same pattern in another.

Find every secret before someone else does.

Scan your code and full git history in under a minute. Free verdict, no signup, nothing leaves your machine.

Try the Browser Scanner → Download for Windows