Securityscan

io.github.securityscan-api

Security for AI agents: MCP audits, secret redaction, skill vetting, network scans, agent checkout.

Add to Cursor Add to VS Code Run on PlugMCP

1{2  "mcpServers": {3    "io.github.securityscan-api-securityscan": {4      "command": "uvx",5      "args": [6        "securityscan-mcp==0.2.0"7      ]8    }9  }10}

.cursor/mcp.jsonMCP server

Transport: stdio
Status: Local

Power your agent

Add this server

The publisher's own command. Not a PlugMCP endpoint.

Add to Cursor Add to VS Code Run on PlugMCP

Host a copy with our keys and logs.

Local command

uvx securityscan-mcp==0.2.0

Claude Code has no install link for a local command. Copy the command below and run it in a terminal.

shClaude Code

1claude mcp add io.github.securityscan-api-securityscan -- uvx securityscan-mcp==0.2.0

Run in a terminal.

jsonClaude Desktop

1{2  "mcpServers": {3    "io.github.securityscan-api-securityscan": {4      "command": "uvx",5      "args": [6        "securityscan-mcp==0.2.0"7      ]8    }9  }10}

claude_desktop_config.json

Local · pypiPublisher installStep-by-step: add this in Claude

Remote URL or a command on your machine? How the two installs differ

Run on PlugMCP

Host a copy with our keys and logs.

A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.

Launch

Server facts

Local

Transport: stdio
Version: 0.2.0
Last checked: 2026-10-28

Stars: —
Tools: —
Uptime: —

Tools

No tool list yet. Remote servers get one after the first health check.

FAQ

Questions

How do I install Securityscan?

Copy the stdio config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.

Does Securityscan need an API key?

No required environment variable is listed on this record.

What transport does Securityscan use?

Securityscan runs locally over stdio.

When was Securityscan last checked?

Last checked 2026-10-28. Security for AI agents: MCP audits, secret redaction, skill vetting, network scans, agent checkout.

From the publisher

Documentation

SecurityScan MCP

Give your AI agent the ability to secure its own environment — one MCP config, eight tools.

Audit MCP configs for poisoning, redact secrets/PII before they leave for an LLM, vet untrusted skills, monitor dependency health, and actively scan your network. All from a single securitystack entry in your agent's MCP config.

This is the client: the unified MCP server an AI agent (Claude CLI/Desktop, or any MCP-aware agent) installs to call the SecurityScan hosted services. The backend services themselves are hosted — you don't run them. You configure API keys and your agent gets eight tools — six security plus two sales.

Why

An AI agent has four ways to get compromised. SecurityScan covers all four:

1. What it INSTALLS   → poisoned skills / MCP configs     → scan_skill + audit_mcp_server_config
2. What it DEPENDS ON → a dependency goes down/rogue        → check_dependencies
3. Where it's EXPOSED → open ports, default creds           → network_scan (with AI agent loop)
4. What it SENDS OUT  → secrets/PII leak into the LLM       → scan_secrets

Two of these — audit_mcp_server_config and scan_secrets — run offline, in-process, with no API key. They work the moment you install the server. The other four call hosted services (configure their keys to enable them; each is skipped gracefully if unset).

Install

1. Install the server

pip install securityscan-mcp

That's it — the package is on PyPI.

2. Add it to your agent

For Claude Desktop / CLI (claude_desktop_config.json or ~/.claude.json):

{
  "mcpServers": {
    "securityscan": {
      "command": "python",
      "args": ["-m", "stack.unified_mcp_server"],
      "env": {
        "ACTIVESCANNER_API_KEY": "ask_live_...",
        "DEPSCAN_API_KEY": "dsk_live_...",
        "SECURITYSCAN_API_KEY": "ss_live_...",
        "SECRETSCAN_API_KEY": "ssc_..."
      }
    }
  }
}

The three offline tools (audit_mcp_server_config, scan_secrets, securitystack_pricing) need no key and work immediately. The four hosted-service tools activate when you set their key; set only what you use.

Get a free API key (no credit card):
curl -X POST https://scan.apisecurityscan.net/v1/register -d '{}'
See docs/QUICKSTART.md for the 2-minute setup.

3. Verify

claude mcp list
# securitystack ... Connected

Then ask your agent: "Audit my MCP config for security risks" or "Scan this prompt for secrets before I send it: ..."

The eight tools

Tool	What it does	Needs a key?
`audit_mcp_server_config`	Audits an MCP config for tool poisoning, leaked credentials, supply-chain risk, toxic capability pairs (OWASP MCP Top 10).	No — runs offline
`scan_secrets`	Detects & redacts secrets (API keys, tokens, private keys) + PII (email, phone, SSN, credit card, IBAN) in a payload before it leaves for an LLM/API. Runs offline in-process with no key; routes to the backend if a key is set.	No — runs offline
`scan_skill`	Analyzes an untrusted AI skill for prompt injection, malware patterns, OWASP LLM Top 10 — before you install it.	`SECURITYSCAN_API_KEY`
`check_dependencies`	Checks the health (uptime, SSL, blacklist, trust score) of endpoints your agent depends on.	`DEPSCAN_API_KEY`
`network_scan`	Active security scan of a device/host with an autonomous AI agent that reasons about findings. Requires `authorized: true` — only scan what you own.	`ACTIVESCANNER_API_KEY`
`full_stack_audit`	All of the above correlated into one prioritized report.	per-tool keys
`securitystack_pricing`	Tier/price/quota catalog with the benchmark evidence behind it — evaluate or recommend a purchase to your user.	No — runs offline
`securitystack_checkout`	Agent-native purchase: opens a Stripe checkout for a tier and returns the payment URL plus a PENDING API key that activates automatically on payment.	No — public endpoint

Authorization & legality

network_scan performs active scanning. You must set authorized: true to certify you own or have permission to scan the target. Scanning without authorization may violate the CFAA (US), the Computer Misuse Act (UK), and similar laws. See the Terms of Service.

License

Apache-2.0. See LICENSE.

Securityscan

io.github.securityscan-api

Security for AI agents: MCP audits, secret redaction, skill vetting, network scans, agent checkout.

E Commerce

Add to Cursor Add to VS Code Run on PlugMCP

GitHub

Add to Cursor Add to VS Code Run on PlugMCP

1{2  "mcpServers": {3    "io.github.securityscan-api-securityscan": {4      "command": "uvx",5      "args": [6        "securityscan-mcp==0.2.0"7      ]8    }9  }10}

.cursor/mcp.jsonMCP server

Transport: stdio
Status: Local

Power your agent

Add this server

The publisher's own command. Not a PlugMCP endpoint.

Add to Cursor Add to VS Code Run on PlugMCP

Host a copy with our keys and logs.

Local command

uvx securityscan-mcp==0.2.0

Claude Code has no install link for a local command. Copy the command below and run it in a terminal.

shClaude Code

1claude mcp add io.github.securityscan-api-securityscan -- uvx securityscan-mcp==0.2.0

Run in a terminal.

jsonClaude Desktop

1{2  "mcpServers": {3    "io.github.securityscan-api-securityscan": {4      "command": "uvx",5      "args": [6        "securityscan-mcp==0.2.0"7      ]8    }9  }10}

claude_desktop_config.json

Local · pypiPublisher installStep-by-step: add this in Claude

Remote URL or a command on your machine? How the two installs differ

Run on PlugMCP

Host a copy with our keys and logs.

A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.

Launch

Server facts

Local

Transport: stdio
Version: 0.2.0
Last checked: 2026-10-28

Stars: —
Tools: —
Uptime: —

Tools

No tool list yet. Remote servers get one after the first health check.

FAQ

Questions

How do I install Securityscan?

Copy the stdio config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.

Does Securityscan need an API key?

No required environment variable is listed on this record.

What transport does Securityscan use?

Securityscan runs locally over stdio.

When was Securityscan last checked?

Last checked 2026-10-28. Security for AI agents: MCP audits, secret redaction, skill vetting, network scans, agent checkout.

From the publisher

Documentation

SecurityScan MCP

Give your AI agent the ability to secure its own environment — one MCP config, eight tools.

Audit MCP configs for poisoning, redact secrets/PII before they leave for an LLM, vet untrusted skills, monitor dependency health, and actively scan your network. All from a single securitystack entry in your agent's MCP config.

Why

An AI agent has four ways to get compromised. SecurityScan covers all four:

1. What it INSTALLS   → poisoned skills / MCP configs     → scan_skill + audit_mcp_server_config
2. What it DEPENDS ON → a dependency goes down/rogue        → check_dependencies
3. Where it's EXPOSED → open ports, default creds           → network_scan (with AI agent loop)
4. What it SENDS OUT  → secrets/PII leak into the LLM       → scan_secrets

Install

1. Install the server

pip install securityscan-mcp

That's it — the package is on PyPI.

2. Add it to your agent

For Claude Desktop / CLI (claude_desktop_config.json or ~/.claude.json):

{
  "mcpServers": {
    "securityscan": {
      "command": "python",
      "args": ["-m", "stack.unified_mcp_server"],
      "env": {
        "ACTIVESCANNER_API_KEY": "ask_live_...",
        "DEPSCAN_API_KEY": "dsk_live_...",
        "SECURITYSCAN_API_KEY": "ss_live_...",
        "SECRETSCAN_API_KEY": "ssc_..."
      }
    }
  }
}

Get a free API key (no credit card):
curl -X POST https://scan.apisecurityscan.net/v1/register -d '{}'
See docs/QUICKSTART.md for the 2-minute setup.

3. Verify

claude mcp list
# securitystack ... Connected

Then ask your agent: "Audit my MCP config for security risks" or "Scan this prompt for secrets before I send it: ..."

The eight tools

Tool	What it does	Needs a key?
`audit_mcp_server_config`	Audits an MCP config for tool poisoning, leaked credentials, supply-chain risk, toxic capability pairs (OWASP MCP Top 10).	No — runs offline
`scan_secrets`	Detects & redacts secrets (API keys, tokens, private keys) + PII (email, phone, SSN, credit card, IBAN) in a payload before it leaves for an LLM/API. Runs offline in-process with no key; routes to the backend if a key is set.	No — runs offline
`scan_skill`	Analyzes an untrusted AI skill for prompt injection, malware patterns, OWASP LLM Top 10 — before you install it.	`SECURITYSCAN_API_KEY`
`check_dependencies`	Checks the health (uptime, SSL, blacklist, trust score) of endpoints your agent depends on.	`DEPSCAN_API_KEY`
`network_scan`	Active security scan of a device/host with an autonomous AI agent that reasons about findings. Requires `authorized: true` — only scan what you own.	`ACTIVESCANNER_API_KEY`
`full_stack_audit`	All of the above correlated into one prioritized report.	per-tool keys
`securitystack_pricing`	Tier/price/quota catalog with the benchmark evidence behind it — evaluate or recommend a purchase to your user.	No — runs offline
`securitystack_checkout`	Agent-native purchase: opens a Stripe checkout for a tier and returns the payment URL plus a PENDING API key that activates automatically on payment.	No — public endpoint

Authorization & legality

License

Apache-2.0. See LICENSE.