We leverage static code analysis to scan open source packages for malicious code. We do this at scale by monitoring npm and pypi registries. But there are false

We leverage static code analysis to scan open source packages for malicious code. We do this at scale by monitoring npm and pypi registries. But there are false positives that require us to manually triage flagged packages. After triaging multiple such packages over a month we see common patterns and decided to experiment with AI agents to ease the triaging process. We built an agentic workflow using Claude Desktop, Model Context Protocol (MCP) server and our static code analysis engine to automate part of the triaging process.