{"name":"com.scanlabsai/scanner","slug":"scanlabsai-scanner","title":"ScanLabsAI Security Scanner","description":"Scan a website for vulnerabilities: OWASP Top 10, CVEs, SSL, headers - with plain-English fixes","url":"https://mcp.market/server/scanlabsai-scanner","rating":null,"grade":"B","score":70,"certified":false,"status":"active","category":"security","tags":["security"],"presence":{"score":18,"stars":null,"forks":null,"downloads_week":96,"last_push_at":null,"license":"MIT"},"uptime":{"percent":100,"checks":2,"ok":2,"last_checked_at":"2026-09-19T21:51:10.658Z","last_ok_at":"2026-09-19T21:51:10.658Z","latency_ms":190},"claimed":false,"transport":"mixed","callable_via_gateway":true,"default_price_micros":0,"repository":null,"website":"https://scanlabsai.com","version":"1.1.0","remotes":[{"type":"streamable-http","url":"https://scanlabsai.com/api/mcp"}],"packages":[{"registryType":"npm","identifier":"@scanlabsai/mcp-server","version":"1.0.0","transport":{"type":"stdio"},"environmentVariables":[{"description":"Your ScanLabsAI API key from https://scanlabsai.com/mcp. Optional: without it you get one free scan per website.","format":"string","isSecret":true,"name":"SCANLABS_API_KEY"}]}],"tools":[{"name":"buy_credits","description":"Get a secure Stripe checkout link to buy an AI credit pack for the signed-in account. Requires a ScanLabsAI API key in the MCP connection. Credits are added automatically once payment completes. Packs: starter (5), pro (15), agency (50).","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"pack":{"type":"string","description":"Pack id: starter, pro, or agency. Defaults to pro."}}}},{"name":"check_credits","description":"Check the signed-in account's AI credit balance. Requires a ScanLabsAI API key in the MCP connection (Authorization: Bearer slai_...). Create one at https://scanlabsai.com/mcp.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{}}},{"name":"compliance_report","description":"Generate a website compliance report — the same automated assessment the ScanLabsAI agency portal runs — covering GDPR/CCPA privacy, WCAG 2.1 AA accessibility, PCI DSS 4.0 payment security and general standards. Returns an overall score, per-category scores and the failing/at-risk checks with recommendations, as Markdown. Requires a ScanLabsAI API key in the connection; costs 1 AI credit per report. Only run against sites you are authorised to assess.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"url":{"type":"string","description":"The website URL to assess for compliance, e.g. https://example.com"}},"required":["url"]}},{"name":"get_fix_guidance","description":"Get detailed, step-by-step remediation guidance for a specific vulnerability or security issue (e.g. \"missing Content-Security-Policy header\", \"SQL injection\", a CVE id). Returns actionable fixes.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"issue":{"type":"string","description":"The vulnerability, finding title, or CVE id to fix."}},"required":["issue"]}},{"name":"get_pricing","description":"Get ScanLabsAI pricing: the free-first-scan policy and AI credit packs.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{}}},{"name":"lookup_cves","description":"Look up recent CVEs from the NIST NVD feed, optionally filtered by keyword. Returns id, severity, score and summary.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"keyword":{"type":"string","description":"Optional keyword, e.g. \"wordpress\" or \"openssl\"."},"limit":{"type":"number","description":"Max results (1-25). Defaults to 10."}}}},{"name":"scan_agent","description":"Red-team an AI agent for security weaknesses — prompt injection, system-prompt leakage, sensitive-data disclosure, unsafe output handling and excessive agency — mapped to the OWASP LLM Top 10, and return a Markdown report. This is agent-to-agent scanning: use it to assess another agent from here. Two target kinds are supported: kind=\"openai\" for an OpenAI-compatible chat-completions endpoint, or kind=\"mcp\" for an MCP server (its tool manifest is audited for tool-poisoning and over-broad capabilities). Requires a ScanLabsAI API key in the connection; each agent scan uses 5 AI credits. Probing is active and adversarial — only scan agents you own or are authorised to test.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"kind":{"type":"string","enum":["openai","mcp"],"description":"Target type: \"openai\" for a chat-completions endpoint, \"mcp\" for an MCP server."},"endpoint":{"type":"string","description":"The agent endpoint URL (chat-completions URL, or MCP server URL)."},"apiKey":{"type":"string","description":"Optional bearer token / API key the target agent requires. Sent to the target only; not stored."},"model":{"type":"string","description":"Model name for OpenAI-compatible endpoints, e.g. gpt-4o-mini."},"deep":{"type":"boolean","description":"Run deeper probes (jailbreak + resource-exhaustion). Defaults to false."}},"required":["kind","endpoint"]}},{"name":"scan_website","description":"Run a ScanLabsAI security scan against a website and return a full Markdown vulnerability report (grouped by severity, with descriptions and remediation) that you can analyse, act on, and the user can save as security-report.md. Checks OWASP Top 10, CVEs, SSL/TLS, security headers and DNS. Use deep=true for a comprehensive scan (40,000+ vectors, slower). Only scan sites the user is authorised to test.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"url":{"type":"string","description":"The website URL to scan, e.g. https://example.com"},"deep":{"type":"boolean","description":"Run a deep scan (comprehensive, slower). Defaults to false."}},"required":["url"]}}],"scan":{"score":70,"grade":"B","scanned_at":"2026-09-19T20:03:26.828Z","report":{"scannerVersion":"0.1.5","scannedAt":"2026-09-19T20:03:26.874Z","components":{"code":{"score":25,"max":25,"notes":["2 source files scanned"]},"reliability":{"score":20,"max":20,"notes":["remote reachable in 532ms"]},"poisoning":{"score":15,"max":15,"notes":["8 tool descriptions checked"]},"auth":{"score":3,"max":15,"notes":["open endpoint exposes 2 write-action tools with no auth"]},"maintenance":{"score":3,"max":15,"notes":["repository not readable: repo not found"]},"identity":{"score":4,"max":10,"notes":["verified namespace with website, no repo"]}},"findings":[{"id":"auth.open-write","severity":"high","component":"auth","title":"Write-action tools reachable without authentication"}],"inputs":{"probes":[{"url":"https://scanlabsai.com/api/mcp","reachable":true,"authRequired":false,"latencyMs":532,"serverInfo":{"name":"scanlabsai","version":"1.0.0"}}],"packages":[{"registryType":"npm","identifier":"@scanlabsai/mcp-server","version":"1.0.0","found":true,"license":"MIT","hasInstallScripts":false,"dependencyCount":0,"publishedAt":"2026-09-14T08:11:30.002Z","repositoryUrl":"git+https://github.com/upside-down-studios/studio.git","weeklyDownloads":96}],"repo":{"found":false,"owner":"upside-down-studios","repo":"studio","error":"repo not found"},"icon":{"url":"https://scanlabsai.com/scanlabs-logo.png","source":"registry"},"presence":{"stars":null,"forks":null,"downloadsWeek":96,"license":"MIT","lastPushAt":null,"score":18}}}},"grade_history":[],"reviews":[]}