{"name":"io.github.Compuute/compuute-scan-api","slug":"compuute-compuute-scan-api","title":"Compuute MCP Security Scanner","description":"Scan any public GitHub MCP-server repo for security issues. 37 MCP-specific L1 rules, 8 languages.","url":"https://mcp.market/server/compuute-compuute-scan-api","rating":null,"grade":"B","score":84,"certified":false,"status":"active","category":"devtools","tags":["devtools","security"],"presence":{"score":18,"stars":0,"forks":0,"downloads_week":null,"last_push_at":"2026-08-25T21:57:30.000Z","license":"MIT"},"uptime":{"percent":100,"checks":28,"ok":28,"last_checked_at":"2026-11-04T14:10:41.307Z","last_ok_at":"2026-11-04T14:10:41.307Z","latency_ms":272},"claimed":false,"transport":"remote","callable_via_gateway":true,"default_price_micros":0,"repository":"https://github.com/Compuute/compuute-scan-api","website":"https://scan.compuute.se","version":"0.3.0","remotes":[{"type":"streamable-http","url":"https://scan.compuute.se/mcp/"}],"packages":[],"tools":[{"name":"scan_mcp_server","description":"Scan a public GitHub MCP-server repository for security issues.\n\n    Clones the repo (shallow, <60s, <200 MB), runs compuute-scan v0.6.2 in\n    static analysis mode (no code execution from the target), and returns a\n    structured report with severity counts, a 0-100 score, and the 10 most\n    severe findings.\n\n    WHEN TO USE:\n      - Before connecting to an unknown MCP server discovered via Anthropic\n        Registry, Smithery, mcp.so, or a Discord recommendation.\n      - Before installing a third-party MCP-server package into a production\n        pipeline.\n      - As part of an agent's pre-commit / pre-deploy due-diligence step\n        when adding new dependencies.\n      - As one input to a multi-source trust evaluation (combine with\n        publisher reputation, package install count, last-update recency).\n\n    WHEN NOT TO USE:\n      - For private repos. Use the on-prem CLI instead:\n          `npx compuute-scan ./path-to-private-repo`\n      - For deep exploitability assessment of a specific code path. This is\n        pattern matching, not dataflow analysis. Book a manual L2-L4 audit\n        at https://compuute.se/audit for that depth.\n      - For non-GitHub hosts (GitLab, Bitbucket, self-hosted). v1 supports\n        github.com only.\n      - For repos > 200 MB or clone time > 60s. The endpoint returns a 413\n        or 504 in those cases — fall back to local CLI.\n\n    EXPECTED RESPONSE TIME:\n      - Median: ~1-2 seconds for small repos (<100 files).\n      - p99: ~10 seconds for medium repos.\n      - Hard timeout at clone=60s, scan=120s combined.\n\n    EXPECTED COST:\n      - Free tier in MVP. Future Pro tier may charge per-scan or per-month.\n\n    DATA FRESHNESS:\n      - Scanner version is reported in response.scanner.version.\n      - L1 rule set freshness reflects compuute-scan releases — see\n        github.com/Compuute/compuute-scan/CHANGELOG.md for the latest CVE\n        and threat-intel response timeline.\n\n    EXAMPLES:\n\n      Example 1 — scan an MCP server you're evaluating:\n        github_url = \"https://github.com/modelcontextprotocol/servers\"\n        → score: 0, summary: {critical: 1, high: 94, medium: 22}\n        → top_findings include SSRF, eval, etc.\n        → recommendation: \"AVOID — 1 critical and 94 high finding(s)...\"\n\n      Example 2 — scan a clean reference implementation:\n        github_url = \"https://github.com/microsoft/azure-devops-mcp\"\n        → score: 90+, summary: {critical: 0, high: 1}\n        → recommendation: \"REVIEW — 1 high finding(s)...\"\n\n      Example 3 — scan your own dev MCP-server before publishing:\n        github_url = \"https://github.com/yourorg/your-mcp\"\n        → audit your own surface before others install it\n\n    OUTPUT FIELDS (stable schema):\n      - repo_url (str): canonical URL of the scanned repo.\n      - score (int): 0-100, higher safer. Coarse summary, not a precision claim.\n      - summary (object): {critical, high, medium, low, info, files_scanned}.\n      - recommendation (str): action guidance derived from severity counts.\n      - findings_count (int): total raw findings (may include false positives).\n      - top_findings (list): up to 10 most severe, each with {id, title,\n        severity, file, line, owasp, cwe}.\n      - l0_discovery (object): MCP transport, tool count, dependency pinning.\n      - performance (object): clone_seconds, scan_seconds, repo_size_bytes.\n      - scanner (object): {name, version, layers_covered}.\n      - _disclaimer (str): MANDATORY triage disclaimer. Read it.\n\n    Args:\n      github_url: Public GitHub HTTPS URL (e.g. https://github.com/org/repo).\n                  Must be public and < 200 MB. v1 is github.com only.\n\n    Returns:\n      Structured scan result. On error, returns {\"error\": code, \"message\": ...}\n      with HTTP-style code (invalid_url, clone_failed, scan_timeout, etc.).\n    ","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"github_url":{"title":"Github Url","type":"string"}},"required":["github_url"],"title":"scan_mcp_serverArguments"}}],"scan":{"score":84,"grade":"B","scanned_at":"2026-09-27T17:07:22.309Z","report":{"scannerVersion":"0.1.9","scannedAt":"2026-09-27T17:07:22.296Z","components":{"code":{"score":-1,"max":25,"notes":["remote-only server, no package to scan"]},"reliability":{"score":20,"max":20,"notes":["remote reachable in 700ms"]},"poisoning":{"score":13,"max":15,"notes":["1 tool descriptions checked"]},"auth":{"score":10,"max":15,"notes":["open endpoint, read-only tools"]},"maintenance":{"score":12,"max":15,"notes":["last push 33 days ago"]},"identity":{"score":8,"max":10,"notes":["registry namespace matches repository owner","GitHub account older than a year"]}},"findings":[{"id":"poison.long-description","severity":"low","component":"poisoning","title":"Unusually long tool description (over 2,000 characters)","evidence":"tool scan_mcp_server: …Scan a public GitHub MCP-server repository for security issues. Clones the repo (shallow, <60s, <200 MB), runs compuute-scan v0.6.2 in static analysis mode (no code execution from the target), and returns a structured report with severity counts, a 0-100 score, and the 10 most severe findings. WHEN TO USE: - Before connecting to an unknown MCP server discovered via Anthropic Registry, Smithery, mcp.so, or a Discord recommendation. - Before installing a third-party MCP-server package into a production pipeline. - As part of an agent's pre-commit / pre-deploy due-diligence step when adding new dependencies. - As one input to a multi-source trust evaluation (combine with publisher reputation, package install count, last-update recency). WHEN NOT TO USE: - For private repos. Use the on-prem CLI instead: `npx compuute-scan ./path-to-private-repo` - For deep exploitability assessment of a specific code path. This is pattern matching, not dataflow analysis. Book a manual L2-L4 audit at https://compuute.se/audit for that depth. - For non-GitHub hosts (GitLab, Bitbucket, self-hosted). v1 supports github.com only. - For repos > 200 MB or clone time > 60s. The endpoint returns a 413 or 504 in those cases — fall back to local CLI. EXPECTED RESPONSE TIME: - Median: ~1-2 seconds for small repos (<100 files). - p99: ~10 seconds for medium repos. - Hard timeout at clone=60s, scan=120s combined. EXPECTED COST: - Free tier in MVP. Future Pro tier may charge per-scan or per-month. DATA FRESHNESS: - Scanner version is reported in response.scanner.version. - L1 rule set freshness reflects compuute-scan releases — see github.com/Compuute/compuute-scan/CHANGELOG.md for the latest CVE and threat-intel response timeline. EXAMPLES: Example 1 — scan an MCP server you're evaluating: github_url = \"https://github.com/modelcontextprotocol/servers\" → score: 0, summary: {critical: 1, high: 94, medium: 22} → top_findings include SSRF, eval, etc. → recommendation: \"AVOID — 1 critical and 94 high finding(s)...\" Example 2 — scan a clean reference implementation: github_url = \"https://github.com/microsoft/azure-devops-mcp\" → score: 90+, summary: {critical: 0, high: 1} → recommendation: \"REVIEW — 1 high finding(s)...\" Example 3 — scan your own dev MCP-server before publishing: github_url = \"https://github.com/yourorg/your-mcp\" → audit your own surface before others install it OUTPUT FIELDS (stable schema): - repo_url (str): canonical URL of the scanned repo. - score (int): 0-100, higher safer. Coarse summary, not a precision claim. - summary (object): {critical, high, medium, low, info, files_scanned}. - recommendation (str): action guidance derived from severity counts. - findings_count (int): total raw findings (may include false positives). - top_findings (list): up to 10 most severe, each with {id, title, severity, file, line, owasp, cwe}. - l0_discovery (object): MCP transport, tool count, dependency pinning. - performance (object): clone_seconds, scan_seconds, repo_size_bytes. - scanner (object): {name, version, layers_covered}. - _disclaimer (str): MANDATORY triage disclaimer. Read it. Args: github_url: Public GitHub HTTPS URL (e.g. https://github.com/org/repo). Must be public and < 200 MB. v1 is github.com only. Returns: Structured scan result. On error, returns {\"error\": code, \"message\": ...} with HTTP-style code (invalid_url, clone_failed, scan_timeout, etc.). …"}],"inputs":{"probes":[{"url":"https://scan.compuute.se/mcp/","reachable":true,"authRequired":false,"latencyMs":700,"serverInfo":{"name":"compuute-scan","version":"1.29.1"}}],"packages":[],"repo":{"found":true,"owner":"Compuute","repo":"compuute-scan-api","archived":false,"pushedAt":"2026-08-25T21:57:30Z","stars":0,"forks":0,"openIssues":9,"ownerType":"User","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/160307775?v=4","ownerCreatedAt":"2024-02-17T06:53:50Z","license":"MIT"},"icon":{"url":"https://avatars.githubusercontent.com/u/160307775?v=4&s=128","source":"github"},"presence":{"stars":0,"forks":0,"downloadsWeek":null,"license":"MIT","lastPushAt":"2026-08-25T21:57:30.000Z","score":18}}}},"grade_history":[],"reviews":[]}