kern review

See it catch a prompt injection — live

async function chat(db, llm, userId) {
  // DB results go straight into prompt
  const history = await db.query(
    `SELECT msg FROM chat
     WHERE user_id = '${userId}'`
  );

  const prompt =
    `Assistant: ${history.rows
      .map(r => r.msg).join('\n')}`

  // User input unsanitized
  return llm.complete(prompt);
}

! indirect-prompt-injection
  DB result 'history' from db.query
  used in LLM prompt without
  sanitization — indirect injection
  risk
  chat.ts:9

~ unguarded-effect
  Network/DB effect without
  auth/validation guard
  chat.ts:3

~ unrecovered-effect
  db effect without error recovery
  chat.ts:3

Syntax linters can miss this class of generated-code bug. kern review follows the data and effect boundaries.

  @kernlang/review — analyzing src/

  ! indirect-prompt-injection
    DB result used in LLM prompt without sanitization
    src/chat/handler.ts:9

  ! llm-output-execution
    LLM output passed to eval() — arbitrary code execution
    src/agent/runner.ts:17

  ! prompt-injection
    User input embedded in prompt without sanitization
    src/api/chat.ts:23

  ~ encoding-bypass
    Decoded content from Buffer.from() used in prompt
    src/utils/decode.ts:50

  ~ json-output-manipulation
    JSON.parse on LLM output without schema validation
    src/api/structured.ts:69

  ~ missing-output-validation
    LLM response used without validation
    src/codegen/generate.ts:75

  ~ unguarded-effect  (×3)
    Network/DB effect without error recovery

  ~ rag-poisoning
    Retrieval result embedded in prompt unsanitized
    src/rag/search.ts:28

  ~ tool-calling-manipulation
    LLM-returned tool calls executed without allowlist
    src/agent/tools.ts:41

  ~ unsanitized-history
    Unsanitized messages spread into LLM API call
    src/chat/multi-turn.ts:63

  ✓ 847 lines scanned · 3 errors · 8 warnings
  ✓ prompt-injection patterns reviewed

Representative output from the security benchmark patterns. The important part is the file:line evidence and rule ID.

What kern review catches

kern review doesn't just lint syntax. It understands concepts: entrypoints, effects, guards, state mutations, boundaries.

How it compares

kern review isn't trying to replace your linter. It catches what they miss.

ESLint and SonarQube have more rules and broader language coverage. kern review focuses on concept-level generated-code analysis, prompt-injection review patterns, and LLM-exportable findings. Use them together.

Prompt injection detection

CWE-1427: Improper Neutralization of Input Used for LLM Prompting. The Kern repo includes a security benchmark with 10 code patterns for LLM prompt-injection style failures.

The benchmark file is public: examples/security-benchmark.ts. Use this table as a reproducible project benchmark, not a universal claim about every codebase.

The practical reason to run Kern here is evidence: it points to the exact source span where untrusted data enters prompts, tools, eval, JSON parsing, or output handling.

kern review examples/security-benchmark.ts

These checks are mapped to prompt-injection and generated-code failure modes such as RAG poisoning, encoding bypass, delimiter injection, tool calling validation, and unsanitized history. Mapped to CWE-1427 and OWASP LLM01:2025.

MCP server security

12 rules purpose-built for MCP servers. Static analysis that scans the code that makes the server dangerous — no running server required.

Mapped to OWASP MCP Top 10 categories with source-code rule IDs for dangerous MCP server patterns.

// Vulnerable MCP server
server.tool('run', 'Run command', {}, async (params) => {
  execSync(`${params.cmd}`);
});

! mcp-command-injection
  Shell command execution in MCP tool handler
  server.ts:3  confidence: 0.95

! mcp-ir-unguarded-effect
  action "run" has shell-exec effect without any guard
  server.ts:3  confidence: 0.90

KERN scans the code that makes the server dangerous. mcp-scan checks running servers. Use both.