SimplyScan

io.simplyscanPublished by simplyscan.ioOfficial publisherv1.0.0Updated Oct 24, 2026

Security, SEO and AI-visibility scanner for web apps · free scans and focused checks via MCP.

VerifiedStreamable HTTPWeb executableWeb Search & ScrapingSecurity & Monitoring

Overview

AI-generated overview

SimplyScan is a remote MCP server that lets an assistant run security, SEO and AI-visibility scans on web apps.

What you can do
SimplyScan exposes scanning capabilities for web applications through a remote MCP endpoint. According to its registry description, it covers security, SEO and AI-visibility checks, and offers free scans plus focused checks. No individual tools are listed in the supplied manifest, so the exact tool names and parameters are not documented here.
When to use it
Relevant when you want an assistant to check a web app's security posture, search-engine optimization, or how visible it is to AI systems, without installing local software. It suits quick, on-demand scans rather than continuous monitoring, since no scheduling or alerting is described.
Requirements
A remote MCP client that supports streamable HTTP, pointed at the provider's API endpoint. The manifest declares no authentication, no environment variables and no headers, and no local package or runtime is needed. Network access to the provider's endpoint is required.
Before you install
The manifest declares no authentication, so it is unclear whether scans are anonymous, rate-limited, or tied to an account, and no credentials are documented. Scanning a site you do not own or control may be unauthorized; confirm you have permission before pointing it at a target. Scan results and target URLs are sent to a third-party service.

Installation

In SourceWeft

  1. Open SimplyScan in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.simplyscan%2Fsimplyscan/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "simplyscan": {
      "type": "http",
      "url": "https://api.simplyscan.io/mcp"
    }
  }
}

Tools

8

scan_website

Scan website

Run a SimplyScan Security Engine security & speed scan (Pro with an entitled API key; otherwise free) of a deployed web app URL. Returns a 0-100 score and findings (exposed secrets, missing Supabase RLS, frontend leaks, speed issues). Best for apps built with Lovable, Bolt, v0, Cursor, Replit, etc.

Parametersurlrequired

scan_local_code

Scan local code

Send selected editor file contents to the SimplyScan Security Engine's deterministic repository rules. Requires a Pro API key. Source leaves the editor, is processed in memory, and is not retained; masked findings are saved in the private scan record. No AI provider receives these files. Code rules analyse JavaScript and TypeScript; other files are checked for secrets only. When no file can be analysed, the result has no score.

Parametersfilesrequired

check_security_headers

Check security headers

Grade a URL's HTTP security headers (CSP, HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy, COOP, COEP) A-F.

Parametersurlrequired

check_ai_visibility

Check AI visibility (AEO)

AEO check: whether AI answer engines (ChatGPT/GPTBot, Claude, Perplexity, Google-Extended, etc.) can crawl and cite the site, plus llms.txt and structured-data signals.

Parametersurlrequired

check_seo

Check on-page SEO

On-page SEO audit of a URL: title, meta description, H1, canonical, indexability, Open Graph, structured data, image alt coverage, sitemap. Returns an A-F grade.

Parametersurlrequired

check_ssl

Check SSL/TLS certificate

Inspect a domain's SSL/TLS certificate: issuer, expiry, protocol, and flags for expiring/self-signed/mismatched certs.

Parametersdomainrequired

check_email_security

Check email security (SPF/DKIM/DMARC)

Check a domain's email authentication: SPF, DKIM (common selectors), and DMARC policy. Flags spoofable domains.

Parametersdomainrequired

check_exposed_files

Check for exposed files

Probe a site for accidentally exposed high-risk files (.env, .git/config, backups, etc.). Reports HTTP status only, never file contents.

Parametersurlrequired

Version history

1
  1. v1.0.0LatestSep 16, 2026

Score

83% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • LicenseNot applicable

    A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.