Compuute MCP Security Scanner MCP server

• scan_mcp_serverFree

  Scan a public GitHub MCP-server repository for security issues. Clones the repo (shallow, <60s, <200 MB), runs compuute-scan v0.6.2 in static analysis mode (no code execution from the target), and returns a structured report with severity counts, a 0-100 score, and the 10 most severe findings. WHEN TO USE: - Before connecting to an unknown MCP server discovered via Anthropic Registry, Smithery, mcp.so, or a Discord recommendation. - Before installing a third-party MCP-server package into a production pipeline. - As part of an agent's pre-commit / pre-deploy due-diligence step when adding new dependencies. - As one input to a multi-source trust evaluation (combine with publisher reputation, package install count, last-update recency). WHEN NOT TO USE: - For private repos. Use the on-prem CLI instead: `npx compuute-scan ./path-to-private-repo` - For deep exploitability assessment of a specific code path. This is pattern matching, not dataflow analysis. Book a manual L2-L4 audit at https://compuute.se/audit for that depth. - For non-GitHub hosts (GitLab, Bitbucket, self-hosted). v1 supports github.com only. - For repos > 200 MB or clone time > 60s. The endpoint returns a 413 or 504 in those cases — fall back to local CLI. EXPECTED RESPONSE TIME: - Median: ~1-2 seconds for small repos (<100 files). - p99: ~10 seconds for medium repos. - Hard timeout at clone=60s, scan=120s combined. EXPECTED COST: - Free tier in MVP. Future Pro tier may charge per-scan or per-month. DATA FRESHNESS: - Scanner version is reported in response.scanner.version. - L1 rule set freshness reflects compuute-scan releases — see github.com/Compuute/compuute-scan/CHANGELOG.md for the latest CVE and threat-intel response timeline. EXAMPLES: Example 1 — scan an MCP server you're evaluating: github_url = "https://github.com/modelcontextprotocol/servers" → score: 0, summary: {critical: 1, high: 94, medium: 22} → top_findings include SSRF, eval, etc. → recommendation: "AVOID — 1 critical and 94 high finding(s)..." Example 2 — scan a clean reference implementation: github_url = "https://github.com/microsoft/azure-devops-mcp" → score: 90+, summary: {critical: 0, high: 1} → recommendation: "REVIEW — 1 high finding(s)..." Example 3 — scan your own dev MCP-server before publishing: github_url = "https://github.com/yourorg/your-mcp" → audit your own surface before others install it OUTPUT FIELDS (stable schema): - repo_url (str): canonical URL of the scanned repo. - score (int): 0-100, higher safer. Coarse summary, not a precision claim. - summary (object): {critical, high, medium, low, info, files_scanned}. - recommendation (str): action guidance derived from severity counts. - findings_count (int): total raw findings (may include false positives). - top_findings (list): up to 10 most severe, each with {id, title, severity, file, line, owasp, cwe}. - l0_discovery (object): MCP transport, tool count, dependency pinning. - performance (object): clone_seconds, scan_seconds, repo_size_bytes. - scanner (object): {name, version, layers_covered}. - _disclaimer (str): MANDATORY triage disclaimer. Read it. Args: github_url: Public GitHub HTTPS URL (e.g. https://github.com/org/repo). Must be public and < 200 MB. v1 is github.com only. Returns: Structured scan result. On error, returns {"error": code, "message": ...} with HTTP-style code (invalid_url, clone_failed, scan_timeout, etc.).

• –Code scanremote-only server, no package to scann/a
• Live reliabilityremote reachable in 700ms20/20
• Tool poisoning1 tool descriptions checked13/15
• Auth qualityopen endpoint, read-only tools10/15
• Maintenancelast push 33 days ago12/15
• Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Safety score

84/100

higher than 68% of 1,119 Developer tools servers

Tools

1

the typical Developer tools server has 7

Tools that change things

0%

typical: 5%. Fewer write tools means less an agent can break

Uptime

100%

of our recent checks; the typical remote Developer tools server answers 100%

Response time

380 ms

faster than 32% of 443 Developer tools servers

Compuute MCP Security Scanner: common questions

Is Compuute MCP Security Scanner MCP server safe?

Mostly: it is graded B (84/100). Read the Compuute MCP Security Scanner safety report

How do I install Compuute MCP Security Scanner?

It runs remotely at scan.compuute.se. Add it to Claude Code, Cursor, VS Code or Claude Desktop with the snippets above, or call it through the mcp.market gateway without installing anything.

Does Compuute MCP Security Scanner need an API key?

Not as far as the registry entry and our scan can tell: no credentials are declared or required.

Is Compuute MCP Security Scanner maintained?

The last commit was 71 days ago (2026-08-25). The latest release is v0.3.0.

Is Compuute MCP Security Scanner up?

100% of our last 28 checks got an answer. We check remote servers about four times a day.

What can I use instead of Compuute MCP Security Scanner?

Servers from other publishers that do the same job: GitHub MCP server, Gk CLI MCP server and OctoCounts MCP Server.

How does Compuute MCP Security Scanner compare with other Developer tools MCP servers?

safety score 84/100 (higher than 68% of 1,119 Developer tools servers); tools 1 (the typical Developer tools server has 7); tools that change things 0% (typical: 5%. Fewer write tools means less an agent can break). Full comparison.