SecurityScan

Working · 2.5 s

net.apisecurityscan/securityscanv1.0.0 Domain verified

Scan GitHub-hosted AI skills for vulnerabilities: prompt injection, malware, OWASP LLM Top 10.

Security

Source Website Registry entry

Maintain this server? Claim it

Try it

Call this server's tools from your browser. Nothing to install.

https://apisecurityscan.net/mcp

X-API-Key (required)

SecurityScan API key (ss_live_...). Register free at https://apisecurityscan.net/auth/register — no payment needed for FREE tier (5 scans/month).

Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.

Tool list from our last check. Connect live to refresh it.

audit_mcp_server_config

Audit an MCP client configuration for security risks — works offline, no external service required. Detects: tool poisoning, hidden/coercive instructions in tool descriptions, hardcoded credentials, unpinned packages (rug-pull risk), insecure transport, and toxic capability combinations (shell + network, file-read + network).

config_jsonstring, required

The FULL JSON content of the MCP config file as a string (e.g. claude_desktop_config.json or .mcp.json). Paste the file content, not the path.

This tool isn't marked read-only, so it may change something on the server or in an account you connected.

I understand, run it anyway

Tools (8)

audit_mcp_server_config

Argument	Type	Description
config_json*	string	The FULL JSON content of the MCP config file as a string (e.g. claude_desktop_config.json or .mcp.json). Paste the file content, not the path.

Input schema (JSON)

{
  "type": "object",
  "required": [
    "config_json"
  ],
  "properties": {
    "config_json": {
      "type": "string",
      "description": "The FULL JSON content of the MCP config file as a string\n         (e.g. claude_desktop_config.json or .mcp.json). Paste the\n         file content, not the path."
    }
  },
  "additionalProperties": false
}

check_dependencies

Check the health of your agent's external dependencies: uptime, SSL validity, blacklist status, and a trust score 0-100 (DepScan).

Argument	Type	Description
endpoints*	array	List of URLs your agent/skill depends on, e.g. ["https://api.openai.com", "https://api.stripe.com"]

Input schema (JSON)

{
  "type": "object",
  "required": [
    "endpoints"
  ],
  "properties": {
    "endpoints": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "List of URLs your agent/skill depends on,\n       e.g. [\"https://api.openai.com\", \"https://api.stripe.com\"]"
    }
  },
  "additionalProperties": false
}

full_stack_audit

Complete security posture in one call: audits the MCP config, checks dependency health, analyzes an untrusted skill, scans the local network gateway, and scans any payload you're about to send out for secrets/PII — then correlates everything into a single prioritized report. Pass only what you have; each section is skipped gracefully if its input or service is missing.

Argument	Type	Description
skill_url	string	untrusted skill to vet (optional)
text_to_scan	string	payload to vet for secret/PII egress (optional)
network_target	string	IP to scan, e.g. "192.168.1.1" (optional)
mcp_config_json	string	MCP config content as string (optional)
network_authorized	boolean	REQUIRED to scan network_target. Set True to certify you own or have permission to scan it. (optional, default False)
dependency_endpoints	any	URLs your stack depends on (optional)

Input schema (JSON)

{
  "type": "object",
  "properties": {
    "skill_url": {
      "type": "string",
      "default": "",
      "description": "untrusted skill to vet (optional)"
    },
    "text_to_scan": {
      "type": "string",
      "default": "",
      "description": "payload to vet for secret/PII egress (optional)"
    },
    "network_target": {
      "type": "string",
      "default": "",
      "description": "IP to scan, e.g. \"192.168.1.1\" (optional)"
    },
    "mcp_config_json": {
      "type": "string",
      "default": "",
      "description": "MCP config content as string (optional)"
    },
    "network_authorized": {
      "type": "boolean",
      "default": false,
      "description": "REQUIRED to scan network_target. Set True to certify\n                you own or have permission to scan it. (optional, default False)"
    },
    "dependency_endpoints": {
      "anyOf": [
        {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "URLs your stack depends on (optional)"
    }
  },
  "additionalProperties": false
}

network_scan

Active security scan of a device or host with an autonomous AI agent that decides which follow-up probes to run (ActiveScanner). Only scan targets you own or have permission to test.

Argument	Type	Description
target*	string	IP, CIDR, or hostname. Examples: "192.168.1.1", "10.0.0.0/24"
scan_type	string	"quick" (~30s, top ports) [default], "standard" (~2min, agent loop), "deep" (~10min, full ports + credentials check)
authorized*	boolean	REQUIRED. You must set this to True to certify that you own the target or have explicit permission to test it. Setting it to False (or omitting it) aborts the scan. Scanning without authorization may be illegal (CFAA / Computer Misuse Act).

Input schema (JSON)

{
  "type": "object",
  "required": [
    "target",
    "authorized"
  ],
  "properties": {
    "target": {
      "type": "string",
      "description": "IP, CIDR, or hostname. Examples: \"192.168.1.1\", \"10.0.0.0/24\""
    },
    "scan_type": {
      "type": "string",
      "default": "quick",
      "description": "\"quick\" (~30s, top ports) [default], \"standard\" (~2min,\n       agent loop), \"deep\" (~10min, full ports + credentials check)"
    },
    "authorized": {
      "type": "boolean",
      "description": "REQUIRED. You must set this to True to certify that you own\n        the target or have explicit permission to test it. Setting it\n        to False (or omitting it) aborts the scan. Scanning without\n        authorization may be illegal (CFAA / Computer Misuse Act)."
    }
  },
  "additionalProperties": false
}

scan_secrets

Scan a text payload (a prompt, an outbound API body, a file's contents) for secrets and PII BEFORE it leaves for an LLM or external API, and return a redacted copy. Catches the #1 real-world agent incident: secrets/PII leaking into a model's context. WORKS OFFLINE with no API key — the detection runs in-process (pure regex + Luhn check, no network). If a SecretScan backend key IS configured, the scan is routed there instead (which also persists an audit record).

Argument	Type	Description
text*	string	The payload to inspect (prompt, request body, document text).
redact	boolean	If True (default), each match is replaced with a token like [REDACTED-KEY] / [REDACTED-EMAIL]. If False, only reports.

Input schema (JSON)

{
  "type": "object",
  "required": [
    "text"
  ],
  "properties": {
    "text": {
      "type": "string",
      "description": "The payload to inspect (prompt, request body, document text)."
    },
    "redact": {
      "type": "boolean",
      "default": true,
      "description": "If True (default), each match is replaced with a token like\n    [REDACTED-KEY] / [REDACTED-EMAIL]. If False, only reports."
    }
  },
  "additionalProperties": false
}

scan_skill

Analyze an AI agent skill for prompt injection, malware patterns, and OWASP LLM Top 10 issues BEFORE installing it (SecurityScan).

Argument	Type	Description
skill_url*	string	URL of the skill to analyze (e.g. a GitHub skill URL).

Input schema (JSON)

{
  "type": "object",
  "required": [
    "skill_url"
  ],
  "properties": {
    "skill_url": {
      "type": "string",
      "description": "URL of the skill to analyze (e.g. a GitHub skill URL)."
    }
  },
  "additionalProperties": false
}

securityscan_checkout

Start a Stripe checkout to buy a SecurityScan tier (agent-native sales). Returns a payment URL to hand to your user AND a PENDING API key that activates automatically once payment clears — no other setup step.

Argument	Type	Description
tier*	string	one of "founder" ($29 one-time), "personal", "executive", "enterprise" (monthly)
email	string	optional — prefills the Stripe checkout page for your user
existing_key	string	optional — upgrade an existing ask_live_ key instead of minting a new one

Input schema (JSON)

{
  "type": "object",
  "required": [
    "tier"
  ],
  "properties": {
    "tier": {
      "type": "string",
      "description": "one of \"founder\" ($29 one-time), \"personal\", \"executive\",\n  \"enterprise\" (monthly)"
    },
    "email": {
      "type": "string",
      "default": "",
      "description": "optional — prefills the Stripe checkout page for your user"
    },
    "existing_key": {
      "type": "string",
      "default": "",
      "description": "optional — upgrade an existing ask_live_ key instead of\n          minting a new one"
    }
  },
  "additionalProperties": false
}

securityscan_pricing

SecurityScan catalog: tiers, prices, quotas and the evidence behind the product — the fact sheet an agent needs to evaluate or recommend a purchase to its user. Fully offline, no API key required. Returns: JSON with the tier table (price / target slots / scan types), the pricing model, benchmark evidence, and how to buy.

No arguments.

Input schema (JSON)

{
  "type": "object",
  "properties": {},
  "additionalProperties": false
}