kern review

See it catch a prompt injection — live

async function chat(db, llm, userId) {
  // DB results go straight into prompt
  const history = await db.query(
    `SELECT msg FROM chat
     WHERE user_id = '${userId}'`
  );

  const prompt =
    `Assistant: ${history.rows
      .map(r => r.msg).join('\n')}`

  // User input unsanitized
  return llm.complete(prompt);
}

! indirect-prompt-injection
  DB result 'history' from db.query
  used in LLM prompt without
  sanitization — indirect injection
  risk
  chat.ts:9

~ unguarded-effect
  Network/DB effect without
  auth/validation guard
  chat.ts:3

~ unrecovered-effect
  db effect without error recovery
  chat.ts:3

ESLint sees nothing. SonarQube sees nothing. kern review catches all three.

  @kernlang/review — analyzing src/

  ! indirect-prompt-injection
    DB result used in LLM prompt without sanitization
    src/chat/handler.ts:9

  ! llm-output-execution
    LLM output passed to eval() — arbitrary code execution
    src/agent/runner.ts:17

  ! prompt-injection
    User input embedded in prompt without sanitization
    src/api/chat.ts:23

  ~ encoding-bypass
    Decoded content from Buffer.from() used in prompt
    src/utils/decode.ts:50

  ~ json-output-manipulation
    JSON.parse on LLM output without schema validation
    src/api/structured.ts:69

  ~ missing-output-validation
    LLM response used without validation
    src/codegen/generate.ts:75

  ~ unguarded-effect  (×3)
    Network/DB effect without error recovery

  ~ rag-poisoning
    Retrieval result embedded in prompt unsanitized
    src/rag/search.ts:28

  ~ tool-calling-manipulation
    LLM-returned tool calls executed without allowlist
    src/agent/tools.ts:41

  ~ unsanitized-history
    Unsanitized messages spread into LLM API call
    src/chat/multi-turn.ts:63

  ✓ 847 lines scanned · 3 errors · 8 warnings
  ✓ 10 prompt injection vectors detected

Real output. Verified against 10 OWASP LLM01 attack vectors. No other SAST tool catches encoding bypasses or delimiter injection.

What kern review catches

kern review doesn't just lint syntax. It understands concepts: entrypoints, effects, guards, state mutations, boundaries.

How it compares

kern review isn't trying to replace your linter. It catches what they miss.

ESLint and SonarQube have more rules and broader language coverage. kern review goes deeper on fewer rules — concept-level analysis, 10/10 prompt injection detection, and LLM-exportable findings. Use them together.

Prompt injection detection

CWE-1427: Improper Neutralization of Input Used for LLM Prompting. kern review detects all 10 attack vectors via static analysis — verified against real code patterns.

Each cell is tested: we ran the same benchmark file through each tool. "Yes" means the tool flagged it. No marketing claims — only verified results.

No official code-level benchmark for CWE-1427 exists yet (OWASP, NIST, and MITRE have prompt-level datasets only). This benchmark is open-source — run it yourself.

# Verify kern
kern review examples/security-benchmark.ts

# Verify Semgrep (same file)
semgrep scan --config p/default --config p/javascript \
  examples/security-benchmark.ts

RAG poisoning, encoding bypass, delimiter injection, tool calling validation, and unsanitized history detection are unique to kern — no other SAST tool catches these. Mapped to CWE-1427 and OWASP LLM01:2025.

MCP server security

12 rules purpose-built for MCP servers. Static analysis that scans the code that makes the server dangerous — no running server required.

Mapped to OWASP MCP Top 10. Verified 9/9 against the appsecco vulnerable MCP servers lab.

// Vulnerable MCP server
server.tool('run', 'Run command', {}, async (params) => {
  execSync(`${params.cmd}`);
});

! mcp-command-injection
  Shell command execution in MCP tool handler
  server.ts:3  confidence: 0.95

! mcp-ir-unguarded-effect
  action "run" has shell-exec effect without any guard
  server.ts:3  confidence: 0.90

KERN scans the code that makes the server dangerous. mcp-scan checks running servers. Use both.