SecScan

us.secscanPublished by secscan.usOfficial publisherv1.1.0Updated Oct 27, 2026

Scan, monitor and fix a live web app from your editor: graded security reports with fix prompts.

VerifiedStreamable HTTPWeb executableDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

SecScan runs graded security scans of web apps you own, returning prioritised findings, fix prompts and continuous monitoring from your editor.

What you can do
  • Start scans of a web app and poll status or wait for completion
  • Read finished reports with grades, tested and skipped areas, prioritised findings, fixes and an AI-editor fix prompt
  • List recent scans, verified domains and remaining scan allowance
  • Start and check domain ownership verification by file or DNS TXT record
  • Add sites to continuous monitoring, list monitors and trigger an on-demand rescan
  • Dismiss a finding as a false positive for a site
When to use it
Useful when you want an assistant to check a live web application you own or are authorised to test, triage and fix findings in the editor, or keep a site under recurring scans with CVE and certificate alerts.
Requirements
Remote streamable HTTP endpoint at secscan.us; no local package. Requires a SecScan account and a bearer token starting with ssk_, sent in the Authorization header. Domain verification (a published file or DNS TXT record) is needed for active tests; scan allowance depends on plan, credits and free scans.
Before you install
The token is a secret sent in the Authorization header. Scans consume free scans, plan scans or credits, and adding a monitor or rescanning may use one. Only scan domains you own or are authorised to test; active tests run only on verified domains. Dismissing a finding changes future reports and should only follow user confirmation.

Installation

In SourceWeft

  1. Open SecScan in the dashboard and add it to a workspace.
  2. Connect Authorization token credentials. They are stored privately and never shown on public pages.
  3. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/us.secscan%2Fsecscan/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "secscan": {
      "type": "http",
      "url": "https://secscan.us/api/mcp",
      "headers": {
        "Authorization": "Bearer <YOUR_TOKEN>"
      }
    }
  }
}

Tools

12

scan_url

Scan a website

Start a SecScan security scan of a web application the user owns or is authorised to test. Returns a scan_id; most scans finish in under a minute — then call get_scan_status with wait_seconds, or get_report. Active tests (injection, XSS, SSRF…) run only on domains the user has verified; others get passive checks. Optionally also reads a GitHub repository's source (github_repo): any public one, or a private one the user connected at secscan.us. That only contacts GitHub, never the site. Each scan uses one of the user's free scans, plan scans or credits.

Parametersurlrequiredgithub_repo

get_scan_status

Check a scan

Status of a scan (queued, scanning, analyzing, complete, failed). With wait_seconds (max 60) it waits for the scan to finish and returns the full report as soon as it does.

Parametersscan_idrequiredwait_seconds

get_report

Read a scan report

The finished report for a scan: grade, what the scan tested and what it skipped (a clean grade says nothing about skipped areas, so say so), prioritised findings with fixes and evidence, and a fix prompt written for the user's AI editor. Findings come 25 per page, most severe first — pass offset for the next page, or min_severity (e.g. "high") to focus on what matters most.

Parameterslimitoffsetscan_idrequiredmin_severity

list_recent_scans

List recent scans

The user's most recent scans with their status, newest first.

Parameterslimit

list_verified_domains

List verified domains

Domains the user has proved they own. Only these receive active testing (injection, XSS, SSRF, access control); others get passive checks. Verify more at https://secscan.us/domains.

Takes no parameters.

get_account

Scans left and plan

How many scans the user can still run — free scans, plan scans and credits — and their plan. Check this before starting several scans.

Takes no parameters.

start_domain_verification

Start verifying a domain

Begin proving the user owns a domain, which unlocks active tests (injection, XSS, SSRF, access control) on its scans. Returns a file to publish on the site, or a DNS TXT record — an editor can usually add the file to the codebase and deploy it. Then call check_domain_verification. Calling it again returns the same token, so a record already published stays valid.

Parametersdomainrequired

check_domain_verification

Check a domain verification

Check whether the file or DNS record from start_domain_verification is live. On success the domain is verified and its next scan includes active tests. DNS changes can take a few minutes.

Parametersdomainrequired

list_monitors

List monitored sites

Sites under continuous monitoring: latest grade, last and next scan, uptime check, CVE alerts, new problems in the last scan and certificate expiry. Use the monitor id with monitor_scan_now.

Takes no parameters.

add_monitor

Monitor a site

Put a site the user owns under continuous monitoring: hourly uptime checks, CVE matching, certificate alerts and regular rescans. Runs a full baseline scan straight away, which uses one of the user's scans exactly as in the app (free for plan holders). Returns the baseline scan_id for get_scan_status.

Parametersurlrequired

monitor_scan_now

Rescan a monitored site now

Run a full scan of a monitored site now instead of waiting for its schedule — e.g. to confirm a fix. Free for plan holders; otherwise uses one of the user's scans, as in the app. Takes the monitor id from list_monitors.

Parametersmonitor_idrequired

dismiss_finding

Dismiss a false positive

Mark a finding as a false positive for this site, so future scans of it stop reporting it — the same as Dismiss in the app, and undoable there. ONLY use this after the user has confirmed the finding is wrong; never dismiss a real problem to improve a grade.

Parametersscan_idrequiredfinding_namerequired

Version history

1
  1. v1.1.0LatestSep 23, 2026

Score

83% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • LicenseNot applicable

    A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.