$ show Nova-Hunting/nova-proximity
Nova Proximity is a modular Python security scanner designed specifically for MCP (Model Context Protocol) servers and Agent Skills. The application provides comprehensive discovery and analysis capabilities, including tool/prompt/resource enumeration for MCP servers and structural/permission analysis for Agent Skills. Its architecture separates concerns into distinct libraries: mcp_scanner_lib for MCP protocol handling, skill_scanner_lib for Agent Skills analysis, and nova_evaluator_lib for NOVA-powered security evaluation. The tool supports multiple transport mechanisms (stdio, SSE, Streamable HTTP) with automatic fallback, provides detailed function signature analysis, and generates actionable security reports with pattern-specific remediation guidance.
The LLM identified 3 files worth highlighting for reuse:
A reusable MCP scanning library that implements full MCP Spec 2025-11-25 support including Streamable HTTP transport, session management, and backwards compatibility with legacy SSE. It cleanly separates endpoint discovery, connection handling, and capability analysis into modular functions. The library demonstrates non-obvious skill in handling MCP protocol nuances, properly extracting and analyzing tools/prompts/resources with function signature generation, and providing robust error handling. It could be extracted and used in other MCP-related projects with minimal modification.
A comprehensive Agent Skills scanning library that parses SKILL.md files with YAML frontmatter, analyzes scripts/references/assets directories, detects suspicious code patterns and imports, evaluates allowed-tools permissions for security risks, and validates hook configurations against Claude Code specifications. It demonstrates strong data engineering practices through its structured approach to skill analysis, pattern-specific remediation guidance, and isolated functionality. The library is self-contained with clear interfaces and could be reused in other skill analysis tools.
A reusable NOVA rule evaluation component that supports multiple rule files and various LLM evaluators (OpenAI, Groq, Anthropic, Azure, Ollama). It provides batch evaluation with progress callbacks, extracts relevant text content from scan results for security analysis, and returns detailed matched/unmatched results with rule-specific information. The component shows good architectural separation by focusing solely on the evaluation logic, making it easy to integrate with different scanners. It handles multiple rules per file and provides rich metadata about matches.