Securityscan

io.github.securityscan-api由 GitHub 帳號 securityscan-api 發布v0.2.0更新於 Oct 24, 2026

Security for AI agents: MCP audits, secret redaction, skill vetting, network scans, agent checkout.

發布方自己的服務：SecurityScan

已驗證STDIO僅桌面開發者工具安全與監控商業與電商

概覽

AI 產生的概覽

本機 MCP 伺服器，讓 AI 助理稽核 MCP 設定、遮蔽機密與個資、審查技能、檢查相依性、掃描網路並購買方案。

可以做什麼
稽核 MCP 伺服器設定，檢查工具投毒、憑證外洩、供應鏈風險與危險能力組合，離線執行且不需金鑰。在送往大型語言模型前偵測並遮蔽機密與個資，預設離線，設定金鑰後改由後端處理。審查不受信任的 AI 技能是否含提示注入與惡意模式，並檢查助理相依端點的健康狀態。以自主代理對主機執行主動網路掃描，需明確授權。將各項結果彙整為一份依優先順序排列的完整報告。顯示方案價格與配額，並開啟 Stripe 結帳，回傳付款連結與待啟用的 API 金鑰。
適用情境
適合想讓助理自行檢查自身環境的情況：安裝前檢查 MCP 設定與技能、從提示中移除敏感資訊，或評估相依性與網路暴露面。也適合讓助理比較方案或發起購買。
執行需求
以本機 Python 程序從 PyPI 安裝，並在助理的 MCP 設定中登記。離線工具不需金鑰；託管工具需以環境變數設定 API 金鑰（SECURITYSCAN_API_KEY、DEPSCAN_API_KEY、ACTIVESCANNER_API_KEY、SECRETSCAN_API_KEY），未設定者會被略過。託管服務需要網路連線。
安裝前請注意
託管工具會將資料送往第三方服務，設定金鑰後 scan_secrets 也會把內容送到後端。network_scan 會執行主動掃描，必須提供 authorized: true；未經許可掃描可能觸法。securitystack_checkout 會啟動真實的 Stripe 付款並產生費用。API 金鑰透過環境變數提供。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Securityscan，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Desktop only，透過 STDIO。 STDIO 服務會啟動本機處理程序，因此需要 SourceWeft 桌面主機。

其他 MCP 客戶端

參照 儲存庫 中的啟動說明。

README

SecurityScan MCP

Give your AI agent the ability to secure its own environment — one MCP config, eight tools.

Audit MCP configs for poisoning, redact secrets/PII before they leave for an LLM, vet untrusted skills, monitor dependency health, and actively scan your network. All from a single securitystack entry in your agent's MCP config.

This is the client: the unified MCP server an AI agent (Claude CLI/Desktop, or any MCP-aware agent) installs to call the SecurityScan hosted services. The backend services themselves are hosted — you don't run them. You configure API keys and your agent gets eight tools — six security plus two sales.

Why

An AI agent has four ways to get compromised. SecurityScan covers all four:

1. What it INSTALLS   → poisoned skills / MCP configs     → scan_skill + audit_mcp_server_config2. What it DEPENDS ON → a dependency goes down/rogue        → check_dependencies3. Where it's EXPOSED → open ports, default creds           → network_scan (with AI agent loop)4. What it SENDS OUT  → secrets/PII leak into the LLM       → scan_secrets

Two of these — audit_mcp_server_config and scan_secrets — run offline, in-process, with no API key. They work the moment you install the server. The other four call hosted services (configure their keys to enable them; each is skipped gracefully if unset).

Install

1. Install the server

bash
pip install securityscan-mcp

That's it — the package is on PyPI.

2. Add it to your agent

For Claude Desktop / CLI (claude_desktop_config.json or ~/.claude.json):

json
{  "mcpServers": {    "securityscan": {      "command": "python",      "args": ["-m", "stack.unified_mcp_server"],      "env": {        "ACTIVESCANNER_API_KEY": "ask_live_...",        "DEPSCAN_API_KEY": "dsk_live_...",        "SECURITYSCAN_API_KEY": "ss_live_...",        "SECRETSCAN_API_KEY": "ssc_..."      }    }  }}

The three offline tools (audit_mcp_server_config, scan_secrets, securitystack_pricing) need no key and work immediately. The four hosted-service tools activate when you set their key; set only what you use.

Get a free API key (no credit card):

bash
curl -X POST https://scan.apisecurityscan.net/v1/register -d '{}'

See docs/QUICKSTART.md for the 2-minute setup.

3. Verify

bash
claude mcp list# securitystack ... Connected

Then ask your agent: "Audit my MCP config for security risks" or "Scan this prompt for secrets before I send it: ..."

The eight tools

ToolWhat it doesNeeds a key?
audit_mcp_server_configAudits an MCP config for tool poisoning, leaked credentials, supply-chain risk, toxic capability pairs (OWASP MCP Top 10).No — runs offline
scan_secretsDetects & redacts secrets (API keys, tokens, private keys) + PII (email, phone, SSN, credit card, IBAN) in a payload before it leaves for an LLM/API. Runs offline in-process with no key; routes to the backend if a key is set.No — runs offline
scan_skillAnalyzes an untrusted AI skill for prompt injection, malware patterns, OWASP LLM Top 10 — before you install it.SECURITYSCAN_API_KEY
check_dependenciesChecks the health (uptime, SSL, blacklist, trust score) of endpoints your agent depends on.DEPSCAN_API_KEY
network_scanActive security scan of a device/host with an autonomous AI agent that reasons about findings. Requires authorized: true — only scan what you own.ACTIVESCANNER_API_KEY
full_stack_auditAll of the above correlated into one prioritized report.per-tool keys
securitystack_pricingTier/price/quota catalog with the benchmark evidence behind it — evaluate or recommend a purchase to your user.No — runs offline
securitystack_checkoutAgent-native purchase: opens a Stripe checkout for a tier and returns the payment URL plus a PENDING API key that activates automatically on payment.No — public endpoint

Authorization & legality

network_scan performs active scanning. You must set authorized: true to certify you own or have permission to scan the target. Scanning without authorization may violate the CFAA (US), the Computer Misuse Act (UK), and similar laws. See the Terms of Service.

License

Apache-2.0. See LICENSE.

來源：README.md，提交 292fd6a

工具

0
SourceWeft 尚未在沙箱中啟動過該軟體包，因此其工具未知。

版本歷史

1
  1. v0.2.0最新Sep 16, 2026

評分

已滿足適用檢查項的 50%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通25 分

    請保持端點能夠回應 MCP 握手；SourceWeft 每 30 天探測一次。

  • 已宣告認證方式10 分

    請在註冊中心條目中宣告憑證請求標頭，或保持端點能夠回應探測，以便判定其認證方式。

  • 已列出工具15 分

    請讓伺服器在無憑證時回應 tools/list，或發布可在沙箱中無憑證啟動的軟體包。

  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分

其他 Apisecurityscan 整合

SecurityScan

net.apisecurityscan官方發布者

遠端 MCP 伺服器，讓助理在安裝前掃描 AI 技能、審核 MCP 設定與依賴，並偵測外洩的機密與個資。

Streamable HTTP可網頁執行驗證方式
開發者工具8 個工具Oct 24, 2026