SecurityScan

net.apisecurityscanPublished by apisecurityscan.netOfficial publisherv1.0.0Updated Oct 24, 2026

Scan GitHub-hosted AI skills for vulnerabilities: prompt injection, malware, OWASP LLM Top 10.

VerifiedStreamable HTTPWeb executableDeveloper ToolsSecurity & MonitoringAI & ML

Overview

AI-generated overview

Remote MCP server that lets an assistant scan AI skills before install, audit MCP configs and dependencies, and catch leaked secrets and PII.

What you can do
Analyze an AI agent skill for prompt injection, malware patterns and OWASP LLM Top 10 issues. Audit an MCP client configuration for tool poisoning, hidden instructions, hardcoded credentials and unpinned packages. Check external dependencies for uptime, SSL validity, blacklist status and a trust score. Run an active network scan of a host you own. Scan text payloads for secrets and PII and return a redacted copy. Correlate results into one prioritized report, and look up pricing or start a checkout.
When to use it
Use it when you want to check a third-party AI skill before installing it, audit an MCP client configuration, check dependency health, or catch secrets and PII before they leave for a model or API. Also suited to getting one combined security posture report.
Requirements
Needs the remote endpoint and an API key in the X-API-Key header (ss_live_ prefix). A free registration gives the FREE tier with 5 scans per month. Some tools (config audit, secret scan, pricing) work offline without a key.
Before you install
Requires the X-API-Key credential. The checkout tool starts a Stripe payment and issues a pending API key, so it spends real money. Only run network scans against targets you own or are authorized to test. Scanned content goes to a third-party service; confirm data flow even for tools described as offline.

Installation

In SourceWeft

  1. Open SecurityScan in the dashboard and add it to a workspace.
  2. Connect X-API-Key credentials. They are stored privately and never shown on public pages.
  3. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/net.apisecurityscan%2Fsecurityscan/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "securityscan": {
      "type": "http",
      "url": "https://apisecurityscan.net/mcp",
      "headers": {
        "X-API-Key": "<YOUR_API_KEY>"
      }
    }
  }
}

README

This repository has no README.

Tools

8

scan_skill

Analyze an AI agent skill for prompt injection, malware patterns, and OWASP LLM Top 10 issues BEFORE installing it (SecurityScan).

Parametersskill_urlrequired

check_dependencies

Check the health of your agent's external dependencies: uptime, SSL validity, blacklist status, and a trust score 0-100 (DepScan).

Parametersendpointsrequired

network_scan

Active security scan of a device or host with an autonomous AI agent that decides which follow-up probes to run (ActiveScanner). Only scan targets you own or have permission to test.

Parameterstargetrequiredscan_typeauthorizedrequired

audit_mcp_server_config

Audit an MCP client configuration for security risks — works offline, no external service required. Detects: tool poisoning, hidden/coercive instructions in tool descriptions, hardcoded credentials, unpinned packages (rug-pull risk), insecure transport, and toxic capability combinations (shell + network, file-read + network).

Parametersconfig_jsonrequired

scan_secrets

Scan a text payload (a prompt, an outbound API body, a file's contents) for secrets and PII BEFORE it leaves for an LLM or external API, and return a redacted copy. Catches the #1 real-world agent incident: secrets/PII leaking into a model's context. WORKS OFFLINE with no API key — the detection runs in-process (pure regex + Luhn check, no network). If a SecretScan backend key IS configured, the scan is routed there instead (which also persists an audit record).

Parameterstextrequiredredact

full_stack_audit

Complete security posture in one call: audits the MCP config, checks dependency health, analyzes an untrusted skill, scans the local network gateway, and scans any payload you're about to send out for secrets/PII — then correlates everything into a single prioritized report. Pass only what you have; each section is skipped gracefully if its input or service is missing.

Parametersskill_urltext_to_scannetwork_targetmcp_config_jsonnetwork_authorizeddependency_endpoints

securityscan_pricing

SecurityScan catalog: tiers, prices, quotas and the evidence behind the product — the fact sheet an agent needs to evaluate or recommend a purchase to its user. Fully offline, no API key required. Returns: JSON with the tier table (price / target slots / scan types), the pricing model, benchmark evidence, and how to buy.

Takes no parameters.

securityscan_checkout

Start a Stripe checkout to buy a SecurityScan tier (agent-native sales). Returns a payment URL to hand to your user AND a PENDING API key that activates automatically once payment clears — no other setup step.

Parameterstierrequiredemailexisting_key

Version history

1
  1. v1.0.0LatestSep 16, 2026

Score

75% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • License10 pts

    Declare a license in the repository or the registry entry.

Other Apisecurityscan integrations

Securityscan

Published by GitHub account securityscan-api

A local MCP server that lets an AI agent audit MCP configs, redact secrets and PII, vet skills, check dependencies, scan networks and buy plans.

STDIODesktop only
Developer ToolsNot validated yetOct 24, 2026