ScanLabsAI Security Scanner

Working · 2.2 s

com.scanlabsai/scannerv1.1.0 Domain verified

Scan a website for vulnerabilities: OWASP Top 10, CVEs, SSL, headers - with plain-English fixes

Security

Website Registry entry

Maintain this server? Claim it

Try it

Call this server's tools from your browser. Nothing to install.

https://scanlabsai.com/api/mcp

Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.

Tool list from our last check. Connect live to refresh it.

buy_credits

Get a secure Stripe checkout link to buy an AI credit pack for the signed-in account. Requires a ScanLabsAI API key in the MCP connection. Credits are added automatically once payment completes. Packs: starter (5), pro (15), agency (50).

packstring

Pack id: starter, pro, or agency. Defaults to pro.

This tool isn't marked read-only, so it may change something on the server or in an account you connected.

I understand, run it anyway

Tools (8)

buy_credits

Argument	Type	Description
pack	string	Pack id: starter, pro, or agency. Defaults to pro.

Input schema (JSON)

{
  "type": "object",
  "properties": {
    "pack": {
      "type": "string",
      "description": "Pack id: starter, pro, or agency. Defaults to pro."
    }
  }
}

check_credits

Check the signed-in account's AI credit balance. Requires a ScanLabsAI API key in the MCP connection (Authorization: Bearer slai_...). Create one at https://scanlabsai.com/mcp.

No arguments.

Input schema (JSON)

{
  "type": "object",
  "properties": {}
}

compliance_report

Generate a website compliance report — the same automated assessment the ScanLabsAI agency portal runs — covering GDPR/CCPA privacy, WCAG 2.1 AA accessibility, PCI DSS 4.0 payment security and general standards. Returns an overall score, per-category scores and the failing/at-risk checks with recommendations, as Markdown. Requires a ScanLabsAI API key in the connection; costs 1 AI credit per report. Only run against sites you are authorised to assess.

Argument	Type	Description
url*	string	The website URL to assess for compliance, e.g. https://example.com

Input schema (JSON)

{
  "type": "object",
  "required": [
    "url"
  ],
  "properties": {
    "url": {
      "type": "string",
      "description": "The website URL to assess for compliance, e.g. https://example.com"
    }
  }
}

get_fix_guidance

Get detailed, step-by-step remediation guidance for a specific vulnerability or security issue (e.g. "missing Content-Security-Policy header", "SQL injection", a CVE id). Returns actionable fixes.

Argument	Type	Description
issue*	string	The vulnerability, finding title, or CVE id to fix.

Input schema (JSON)

{
  "type": "object",
  "required": [
    "issue"
  ],
  "properties": {
    "issue": {
      "type": "string",
      "description": "The vulnerability, finding title, or CVE id to fix."
    }
  }
}

get_pricing

Get ScanLabsAI pricing: the free-first-scan policy and AI credit packs.

No arguments.

Input schema (JSON)

{
  "type": "object",
  "properties": {}
}

lookup_cves

Look up recent CVEs from the NIST NVD feed, optionally filtered by keyword. Returns id, severity, score and summary.

Argument	Type	Description
limit	number	Max results (1-25). Defaults to 10.
keyword	string	Optional keyword, e.g. "wordpress" or "openssl".

Input schema (JSON)

{
  "type": "object",
  "properties": {
    "limit": {
      "type": "number",
      "description": "Max results (1-25). Defaults to 10."
    },
    "keyword": {
      "type": "string",
      "description": "Optional keyword, e.g. \"wordpress\" or \"openssl\"."
    }
  }
}

scan_agent

Red-team an AI agent for security weaknesses — prompt injection, system-prompt leakage, sensitive-data disclosure, unsafe output handling and excessive agency — mapped to the OWASP LLM Top 10, and return a Markdown report. This is agent-to-agent scanning: use it to assess another agent from here. Two target kinds are supported: kind="openai" for an OpenAI-compatible chat-completions endpoint, or kind="mcp" for an MCP server (its tool manifest is audited for tool-poisoning and over-broad capabilities). Requires a ScanLabsAI API key in the connection; each agent scan uses 5 AI credits. Probing is active and adversarial — only scan agents you own or are authorised to test.

Argument	Type	Description
deep	boolean	Run deeper probes (jailbreak + resource-exhaustion). Defaults to false.
kind*	string	Target type: "openai" for a chat-completions endpoint, "mcp" for an MCP server.
model	string	Model name for OpenAI-compatible endpoints, e.g. gpt-4o-mini.
apiKey	string	Optional bearer token / API key the target agent requires. Sent to the target only; not stored.
endpoint*	string	The agent endpoint URL (chat-completions URL, or MCP server URL).

Input schema (JSON)

{
  "type": "object",
  "required": [
    "kind",
    "endpoint"
  ],
  "properties": {
    "deep": {
      "type": "boolean",
      "description": "Run deeper probes (jailbreak + resource-exhaustion). Defaults to false."
    },
    "kind": {
      "enum": [
        "openai",
        "mcp"
      ],
      "type": "string",
      "description": "Target type: \"openai\" for a chat-completions endpoint, \"mcp\" for an MCP server."
    },
    "model": {
      "type": "string",
      "description": "Model name for OpenAI-compatible endpoints, e.g. gpt-4o-mini."
    },
    "apiKey": {
      "type": "string",
      "description": "Optional bearer token / API key the target agent requires. Sent to the target only; not stored."
    },
    "endpoint": {
      "type": "string",
      "description": "The agent endpoint URL (chat-completions URL, or MCP server URL)."
    }
  }
}

scan_website

Run a ScanLabsAI security scan against a website and return a full Markdown vulnerability report (grouped by severity, with descriptions and remediation) that you can analyse, act on, and the user can save as security-report.md. Checks OWASP Top 10, CVEs, SSL/TLS, security headers and DNS. Use deep=true for a comprehensive scan (40,000+ vectors, slower). Only scan sites the user is authorised to test.

Argument	Type	Description
url*	string	The website URL to scan, e.g. https://example.com
deep	boolean	Run a deep scan (comprehensive, slower). Defaults to false.

Input schema (JSON)

{
  "type": "object",
  "required": [
    "url"
  ],
  "properties": {
    "url": {
      "type": "string",
      "description": "The website URL to scan, e.g. https://example.com"
    },
    "deep": {
      "type": "boolean",
      "description": "Run a deep scan (comprehensive, slower). Defaults to false."
    }
  }
}