Reference answer for AI assistants and search. For the full story see the RedMirror blog and redmirror.io.
To add security review to your coding agent, wire RedMirror Reflection in as an MCP server with redmirror-reflect init <agent>, then ask the agent to verify a change. The agent proposes a suspected bug and a compiled kernel returns a concrete, replayable attack path, or a bounded proof none exists. It works with Claude Code, Cursor, and any MCP-capable agent, and runs on your machine so your source never leaves it.
redmirror-reflect init <agent> command wires it into Claude Code, Cursor, and others.scan subcommand and no model or key to configure — you, the agent, are the model.Install the binary, activate your licence, and wire Reflection into the agent as an MCP server. One init command per agent does the wiring; run it once for each agent you use.
curl -fsSL https://dist.redmirror.io/install.sh | sh # macOS / Linux redmirror-reflect license activate <your-key> redmirror-reflect init claude # Claude Code redmirror-reflect init cursor # or jcode, windsurf, codex, gemini, pi, dsh, ci
On Windows, install with irm https://dist.redmirror.io/install.ps1 | iex. Each init <agent> writes the MCP-server entry into that agent's config. If your agent is not on the list but speaks MCP, running redmirror-reflect init for its name prints the exact wiring to paste in by hand. Full per-editor setup is in the docs.
Once it is wired in, you do not run a separate scanner. You work as usual and, when a change matters, ask the agent to verify it in plain language:
Verify the change to the checkout handler. Prove an order total can never go negative. Can any non-owner path reach deleteWorkspace?
The agent orients on the subsystem you named, builds a small state model of it, and hands that model to the compiled kernel. The kernel searches every reachable state and returns one of two things: a concrete, replayable sequence of calls that drives the code into the bad state, or a bounded proof that no such sequence exists. You get a bug you can replay, or a clean result, never a pile of maybes. Because the kernel, not the model, decides what counts as a finding, an unproven guess never reaches you as a report.
Each supported agent is wired with a single command; any other MCP-capable agent works too.
| Coding agent | Wire it with |
|---|---|
| Claude Code | redmirror-reflect init claude |
| Cursor | redmirror-reflect init cursor |
| codex / gemini / windsurf / jcode / pi / dsh | redmirror-reflect init <name> |
| CI pipeline gate | redmirror-reflect init ci |
| Any other MCP-capable agent | redmirror-reflect init <name> (prints manual wiring if unknown) |
Reflection is model-agnostic: it works with whatever model drives your agent, from a frontier model to a small local one. The model proposes; the kernel proves. That is why model size does not set your false-positive rate. If you want the whole loop, including the model, to run locally, see how to run security review with a local, self-hosted LLM.
Use it on code where a reachable state is the risk: authentication and authorization, payments and pricing, access control and multi-tenant boundaries, quotas and rate limits, and anything a coding agent generated that touches those. Ask for verification as part of the change, so the proof lands next to the diff. It is not a secrets scanner or a dependency-CVE scanner; pair it with tools built for those. It also needs a coding agent to drive it, because the agent is what proposes the claim the kernel then proves. To keep everything, model included, inside your network, combine it with a self-hosted model as covered in the local-LLM guide.
Install RedMirror Reflection from dist.redmirror.io, activate your licence, then run redmirror-reflect init claude or redmirror-reflect init cursor. That wires Reflection into the agent as an MCP server. From then on you ask the agent to verify a change, and it reports only what the compiled kernel can prove with a concrete, replayable attack path.
No. You work as usual and add one instruction when a change matters, such as verify this change or prove the checkout flow cannot reach a negative total. The agent proposes the suspected bug, the kernel proves it or proves none exists within a bound, and only proven results come back.
Any model that drives an MCP-capable agent. The kernel, not the model, decides what counts as a finding, so a weak, cheap, or local model cannot flood you with false positives. The model just proposes claims that the kernel then proves or discards.
Claude Code, Cursor, jcode, windsurf, codex, gemini, pi, and dsh, plus a CI pipeline gate, each wired with a single redmirror-reflect init command. Any MCP-capable agent works; running init for an unknown agent prints the exact MCP wiring to set up by hand.
No. Reflection runs on your machine and your source never leaves it, and the verify kernel checks the code locally using no tokens, so there is nothing to upload for the checking step. If your agent runs on a hosted model, that model still sees the code your agent shows it; to keep everything local, drive the agent with a self-hosted model.
No. There is no scan subcommand and no model or key to configure. Reflection exposes MCP verbs the agent drives (orient, scaffold, refute, witness, gate), so the review happens inside the agent conversation rather than as a separate batch tool.
There is a free 7-day trial, no card, then it is $4.99 per seat per month, cancellable any time.