Securityscan

io.github.securityscan-apiPublished by GitHub account securityscan-apiv0.2.0Updated Oct 24, 2026

Security for AI agents: MCP audits, secret redaction, skill vetting, network scans, agent checkout.

The publisher's own server: SecurityScan

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & MonitoringBusiness & Commerce

Overview

AI-generated overview

A local MCP server that lets an AI agent audit MCP configs, redact secrets and PII, vet skills, check dependencies, scan networks and buy plans.

What you can do
Audit MCP server configs for tool poisoning, leaked credentials, supply-chain risk and toxic capability pairs, offline with no key required. Detect and redact secrets and PII in a payload before it is sent to an LLM, offline by default or routed to the backend when a key is set. Vet untrusted AI skills for prompt injection and malware patterns, and check the health of endpoints the agent depends on. Run an active network scan of a host with an autonomous agent, requiring explicit authorization. Correlate findings into one prioritized full-stack report. Show plan pricing and quotas, and open a Stripe checkout that returns a payment link and a pending API key.
When to use it
Useful when you want an agent to police its own setup: checking MCP configs and skills before installing them, stripping secrets from prompts, or reviewing dependency and network exposure. Also relevant if you want the agent to compare plans or start a purchase.
Requirements
Runs as a local Python process installed from PyPI, configured in the agent's MCP config. The offline tools need no key; the hosted tools need API keys set as environment variables (SECURITYSCAN_API_KEY, DEPSCAN_API_KEY, ACTIVESCANNER_API_KEY, SECRETSCAN_API_KEY), and unset keys cause those tools to be skipped. Hosted services require network access.
Before you install
Hosted tools send data to third-party services, and scan_secrets routes payloads to the backend when a key is set. network_scan performs active scanning and requires authorized: true; scanning without permission may be illegal. securitystack_checkout opens a real Stripe payment flow and spends money. API keys are supplied through environment variables.

Installation

In SourceWeft

  1. Open Securityscan in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

SecurityScan MCP

Give your AI agent the ability to secure its own environment — one MCP config, eight tools.

Audit MCP configs for poisoning, redact secrets/PII before they leave for an LLM, vet untrusted skills, monitor dependency health, and actively scan your network. All from a single securitystack entry in your agent's MCP config.

This is the client: the unified MCP server an AI agent (Claude CLI/Desktop, or any MCP-aware agent) installs to call the SecurityScan hosted services. The backend services themselves are hosted — you don't run them. You configure API keys and your agent gets eight tools — six security plus two sales.

Why

An AI agent has four ways to get compromised. SecurityScan covers all four:

1. What it INSTALLS   → poisoned skills / MCP configs     → scan_skill + audit_mcp_server_config2. What it DEPENDS ON → a dependency goes down/rogue        → check_dependencies3. Where it's EXPOSED → open ports, default creds           → network_scan (with AI agent loop)4. What it SENDS OUT  → secrets/PII leak into the LLM       → scan_secrets

Two of these — audit_mcp_server_config and scan_secrets — run offline, in-process, with no API key. They work the moment you install the server. The other four call hosted services (configure their keys to enable them; each is skipped gracefully if unset).

Install

1. Install the server

bash
pip install securityscan-mcp

That's it — the package is on PyPI.

2. Add it to your agent

For Claude Desktop / CLI (claude_desktop_config.json or ~/.claude.json):

json
{  "mcpServers": {    "securityscan": {      "command": "python",      "args": ["-m", "stack.unified_mcp_server"],      "env": {        "ACTIVESCANNER_API_KEY": "ask_live_...",        "DEPSCAN_API_KEY": "dsk_live_...",        "SECURITYSCAN_API_KEY": "ss_live_...",        "SECRETSCAN_API_KEY": "ssc_..."      }    }  }}

The three offline tools (audit_mcp_server_config, scan_secrets, securitystack_pricing) need no key and work immediately. The four hosted-service tools activate when you set their key; set only what you use.

Get a free API key (no credit card):

bash
curl -X POST https://scan.apisecurityscan.net/v1/register -d '{}'

See docs/QUICKSTART.md for the 2-minute setup.

3. Verify

bash
claude mcp list# securitystack ... Connected

Then ask your agent: "Audit my MCP config for security risks" or "Scan this prompt for secrets before I send it: ..."

The eight tools

ToolWhat it doesNeeds a key?
audit_mcp_server_configAudits an MCP config for tool poisoning, leaked credentials, supply-chain risk, toxic capability pairs (OWASP MCP Top 10).No — runs offline
scan_secretsDetects & redacts secrets (API keys, tokens, private keys) + PII (email, phone, SSN, credit card, IBAN) in a payload before it leaves for an LLM/API. Runs offline in-process with no key; routes to the backend if a key is set.No — runs offline
scan_skillAnalyzes an untrusted AI skill for prompt injection, malware patterns, OWASP LLM Top 10 — before you install it.SECURITYSCAN_API_KEY
check_dependenciesChecks the health (uptime, SSL, blacklist, trust score) of endpoints your agent depends on.DEPSCAN_API_KEY
network_scanActive security scan of a device/host with an autonomous AI agent that reasons about findings. Requires authorized: true — only scan what you own.ACTIVESCANNER_API_KEY
full_stack_auditAll of the above correlated into one prioritized report.per-tool keys
securitystack_pricingTier/price/quota catalog with the benchmark evidence behind it — evaluate or recommend a purchase to your user.No — runs offline
securitystack_checkoutAgent-native purchase: opens a Stripe checkout for a tier and returns the payment URL plus a PENDING API key that activates automatically on payment.No — public endpoint

Authorization & legality

network_scan performs active scanning. You must set authorized: true to certify you own or have permission to scan the target. Scanning without authorization may violate the CFAA (US), the Computer Misuse Act (UK), and similar laws. See the Terms of Service.

License

Apache-2.0. See LICENSE.

Source: README.md at commit 292fd6a

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.2.0LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

Other Apisecurityscan integrations

SecurityScan

net.apisecurityscanOfficial publisher

Remote MCP server that lets an assistant scan AI skills before install, audit MCP configs and dependencies, and catch leaked secrets and PII.

Streamable HTTPWeb executableAuth
Developer Tools8 toolsOct 24, 2026