Securityscan

io.github.securityscan-api由 GitHub 账号 securityscan-api 发布v0.2.0更新于 Oct 24, 2026

Security for AI agents: MCP audits, secret redaction, skill vetting, network scans, agent checkout.

发布方自己的服务：SecurityScan

已验证STDIO仅桌面开发者工具安全与监控商业与电商

概览

AI 生成的概览

本地 MCP 服务器，让 AI 助手审计 MCP 配置、脱敏密钥与个人数据、审查技能、检查依赖、扫描网络并购买套餐。

可以做什么
审计 MCP 服务器配置，检查工具投毒、凭据泄露、供应链风险和危险能力组合，离线运行且无需密钥。在发送给大模型前检测并脱敏密钥与个人数据，默认离线，设置密钥后转由后端处理。审查不可信的 AI 技能是否存在提示注入和恶意模式，并检查助手所依赖端点的健康状况。以自主代理对主机执行主动网络扫描，需显式授权。将各项结果汇总为一份按优先级排序的完整报告。展示套餐价格与配额，并打开 Stripe 结账，返回支付链接和待激活的 API 密钥。
适用场景
适合希望助手自查自身环境的场景：安装前检查 MCP 配置和技能、从提示中清除敏感信息，或评估依赖与网络暴露面。也适用于让助手比较套餐或发起购买。
运行要求
作为本地 Python 进程从 PyPI 安装，并在助手的 MCP 配置中登记。离线工具无需密钥；托管工具需通过环境变量设置 API 密钥（SECURITYSCAN_API_KEY、DEPSCAN_API_KEY、ACTIVESCANNER_API_KEY、SECRETSCAN_API_KEY），未设置的会被跳过。托管服务需要网络访问。
安装前请注意
托管工具会把数据发送给第三方服务，设置密钥后 scan_secrets 也会将内容发往后端。network_scan 执行主动扫描，必须提供 authorized: true；未经许可扫描可能违法。securitystack_checkout 会发起真实的 Stripe 支付并产生费用。API 密钥通过环境变量提供。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Securityscan，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Desktop only，通过 STDIO。 STDIO 服务会启动本地进程，因此需要 SourceWeft 桌面宿主。

其他 MCP 客户端

参照 仓库 中的启动说明。

README

SecurityScan MCP

Give your AI agent the ability to secure its own environment — one MCP config, eight tools.

Audit MCP configs for poisoning, redact secrets/PII before they leave for an LLM, vet untrusted skills, monitor dependency health, and actively scan your network. All from a single securitystack entry in your agent's MCP config.

This is the client: the unified MCP server an AI agent (Claude CLI/Desktop, or any MCP-aware agent) installs to call the SecurityScan hosted services. The backend services themselves are hosted — you don't run them. You configure API keys and your agent gets eight tools — six security plus two sales.

Why

An AI agent has four ways to get compromised. SecurityScan covers all four:

1. What it INSTALLS   → poisoned skills / MCP configs     → scan_skill + audit_mcp_server_config2. What it DEPENDS ON → a dependency goes down/rogue        → check_dependencies3. Where it's EXPOSED → open ports, default creds           → network_scan (with AI agent loop)4. What it SENDS OUT  → secrets/PII leak into the LLM       → scan_secrets

Two of these — audit_mcp_server_config and scan_secrets — run offline, in-process, with no API key. They work the moment you install the server. The other four call hosted services (configure their keys to enable them; each is skipped gracefully if unset).

Install

1. Install the server

bash
pip install securityscan-mcp

That's it — the package is on PyPI.

2. Add it to your agent

For Claude Desktop / CLI (claude_desktop_config.json or ~/.claude.json):

json
{  "mcpServers": {    "securityscan": {      "command": "python",      "args": ["-m", "stack.unified_mcp_server"],      "env": {        "ACTIVESCANNER_API_KEY": "ask_live_...",        "DEPSCAN_API_KEY": "dsk_live_...",        "SECURITYSCAN_API_KEY": "ss_live_...",        "SECRETSCAN_API_KEY": "ssc_..."      }    }  }}

The three offline tools (audit_mcp_server_config, scan_secrets, securitystack_pricing) need no key and work immediately. The four hosted-service tools activate when you set their key; set only what you use.

Get a free API key (no credit card):

bash
curl -X POST https://scan.apisecurityscan.net/v1/register -d '{}'

See docs/QUICKSTART.md for the 2-minute setup.

3. Verify

bash
claude mcp list# securitystack ... Connected

Then ask your agent: "Audit my MCP config for security risks" or "Scan this prompt for secrets before I send it: ..."

The eight tools

ToolWhat it doesNeeds a key?
audit_mcp_server_configAudits an MCP config for tool poisoning, leaked credentials, supply-chain risk, toxic capability pairs (OWASP MCP Top 10).No — runs offline
scan_secretsDetects & redacts secrets (API keys, tokens, private keys) + PII (email, phone, SSN, credit card, IBAN) in a payload before it leaves for an LLM/API. Runs offline in-process with no key; routes to the backend if a key is set.No — runs offline
scan_skillAnalyzes an untrusted AI skill for prompt injection, malware patterns, OWASP LLM Top 10 — before you install it.SECURITYSCAN_API_KEY
check_dependenciesChecks the health (uptime, SSL, blacklist, trust score) of endpoints your agent depends on.DEPSCAN_API_KEY
network_scanActive security scan of a device/host with an autonomous AI agent that reasons about findings. Requires authorized: true — only scan what you own.ACTIVESCANNER_API_KEY
full_stack_auditAll of the above correlated into one prioritized report.per-tool keys
securitystack_pricingTier/price/quota catalog with the benchmark evidence behind it — evaluate or recommend a purchase to your user.No — runs offline
securitystack_checkoutAgent-native purchase: opens a Stripe checkout for a tier and returns the payment URL plus a PENDING API key that activates automatically on payment.No — public endpoint

Authorization & legality

network_scan performs active scanning. You must set authorized: true to certify you own or have permission to scan the target. Scanning without authorization may violate the CFAA (US), the Computer Misuse Act (UK), and similar laws. See the Terms of Service.

License

Apache-2.0. See LICENSE.

来源：README.md，提交 292fd6a

工具

0
SourceWeft 尚未在沙箱中启动过该软件包，因此其工具未知。

版本历史

1
  1. v0.2.0最新Sep 16, 2026

评分

已满足适用检查项的 50%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通25 分

    请保持端点能够响应 MCP 握手；SourceWeft 每 30 天探测一次。

  • 已声明认证方式10 分

    请在注册中心条目中声明凭据请求头，或保持端点能够响应探测，以便判定其认证方式。

  • 已列出工具15 分

    请让服务器在无凭据时响应 tools/list，或发布可在沙箱中无凭据启动的软件包。

  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分

其他 Apisecurityscan 集成

SecurityScan

net.apisecurityscan官方发布者

远程 MCP 服务器，让助手在安装前扫描 AI 技能、审核 MCP 配置与依赖，并检测外泄的机密与个人数据。

Streamable HTTP可网页运行鉴权
开发者工具8 个工具Oct 24, 2026