{"id":"pantheon-security-medusa","name":"medusa","af_score":45.2,"security_score":32.5,"reliability_score":32.5,"what_it_does":"MEDUSA is an open-source (Python) AI-first security scanner/CLI that detects vulnerabilities and insecure patterns in traditional code as well as AI/ML and agent/LLM application artifacts (including prompt-injection style rules, RAG pipeline risks, MCP server configurations, and repo poisoning via editor/agent configuration files). It also supports scanning local directories and (optionally) cloning/scanning GitHub repos via a --git flag, producing reports in multiple formats (JSON/HTML/Markdown/SARIF).","best_when":"You need automated, repeatable static analysis of both code and AI/agent-related artifacts before deployment, especially in CI pipelines for ML/LLM projects and repos with MCP/tooling configurations.","avoid_when":"You require guarantees equivalent to dynamic testing, or you cannot tolerate false positives/heuristics inherent to static pattern scanning without review and tuning.","last_evaluated":"2026-03-30T13:38:56.152479+00:00","has_mcp":false,"has_api":false,"auth_methods":[],"has_free_tier":false,"known_gotchas":["Static scanning can produce false positives; agents should review outputs and possibly tune configuration via .medusa.yml.","Remote repo scanning via --git may depend on network access/clone permissions; agents may need to handle transient network failures.","Optional external linters are environment-dependent; results may vary based on installed tooling."],"error_quality":0.0}