Edit

Codename MDASH overview (preview)

Codename MDASH is an agentic code scanner within Microsoft Defender that uses a multi-model agentic AI system to assist security and engineering teams detect and fix code vulnerabilities with unprecedented depth and accuracy.

How it works

This service uses a multistage agentic pipeline where specialized AI agents collaborate to find, validate, and prove vulnerabilities:

  • Prepare — The system ranks files by risk using call-graph analysis and code complexity metrics, prioritizing functions most likely to contain vulnerabilities.
  • Scan — More than 100 specialized AI agents (for example, injection-auditor, memory-safety-auditor, auth-bypass-auditor) analyze the ranked code using multiple LLMs. Each agent targets a specific vulnerability class.
  • Validate — The system uses taint analysis and type resolution through Language Server Protocol (LSP) servers. A multi-model agentic debate refines confidence and eliminates false positives.
  • Dedup — The system consolidates duplicate findings, producing a final set of unique, actionable vulnerabilities.

Key features & capabilities

Capability Description
AI-powered vulnerability detection Submits code repositories to a multi-model agentic pipeline that identifies vulnerabilities with greater depth than traditional, pattern-matching static analysis.
Granular confidence scoring Rates each finding with a confidence score so teams can prioritize with precision.
AI-generated code fixes Uses the defender fix command in the Defender CLI to generate and apply code fixes directly from scan results.
Centralized results in Defender portal Publishes findings to Microsoft Security Exposure Management for organization-wide tracking and triage.
Deployment and developer integration Connects directly to GitHub and Azure DevOps using connecters, triggers on-demand scans locally or in the CI/CD via Defender CLI and integrates with AI coding environments using a dedicated agentic SKILL.

Language support

MDASH detects your project's language(s) automatically based on file extensions, and will use specialized language-specific sub agents to detect vulnerabilities in the following languages:

Language File Extension(s)
Java .java
C/C++ .c, .h, .c.in, .cc, .cpp, .cxx, .hh, .hpp
C# .cs
JavaScript** / TypeScript .js, .mjs, .cjs, .ts, .tsx, .mts **Minified Javascipt is currently excluded from the languages MDASH supports.
Python .py, .pyw

Additional Languages Supported by Generalist Sub-Agents

If your repository contains additional common file types, MDASH will use general purpose vulnerability discovery sub-agents to scan these files, and scan quality will vary.

Language File Extension(s)
Objective-C .m
Objective-C++ .mm
Go .go
Kotlin .kt, .k, .kts
PHP .php, .phtml, .inc, .module, .install, .theme
Ruby .rb
Rust .rs
Swift .swift
Zig .zig

Requirements

Allow list

The following domains must be reachable from the machine or pipeline running the CLI.

Required for defender scan ai-scan

  • *.cli.dfd.security.azure.com
  • *.blob.core.windows.net
  • *.azurefd.net
  • *.login.microsoftonline.com
  • *.graph.microsoft.com

Required for GitHub Actions (OIDC)

  • *.token.actions.githubusercontent.com

Required for Azure Pipelines (OIDC)

  • *.dev.azure.com

Recommended for telemetry

  • *.in.applicationinsights.azure.com
  • *.dc.services.visualstudio.com

Optional

  • *.aka.ms

Required for scan fs

  • *.ghcr.io
  • *.public.ecr.aws
  • *.registry-1.docker.io
  • *.auth.docker.io

Cloud and region support

Codename MDASH - Agentic code scanner is available in the Azure commercial cloud in the following regions:

  • US (United States)
  • EU (Europe)
  • UK (United Kingdom)
  • AUS (Australia)
  • IND (India)
  • CH (Switzerland)
  • UAE (United Arab Emirates)
    • UAE currently supports MDASH CLI scans only.

Next steps

  • Last updated on