Best security scanner for Windsurf

Windsurf shares Cursor's pattern: a rules file (.windsurfrules) that belongs in .gitignore but won't add itself there. On top of that comes an extra layer — agentic mode connects to MCP servers, and those carry their own attack surface: poisoned tool descriptions, unpinned versions, secrets in configuration.

Ranking: 1. Grove Vibe Check (the only one with a dedicated MCP security scan alongside the external build scan), 2. Semgrep (rules for agent-generated code), 3. Snyk (dependencies the agent likes to add), 4. Aikido Security, 5. AquilaX. MCP is a surface classic scanners simply don't see, no matter how good their SAST is.