MCP.Market

Securityscan MCP server

by securityscan-api·io.github.securityscan-api/securityscan·v0.2.0
No reviews yet

Security for AI agents: MCP audits, secret redaction, skill vetting, network scans, agent checkout.

A85/100grade A
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
A85/100

full report

Adoption
New

0 stars21 downloads/wk

Reviews

Write one

Nobody has reviewed Securityscan yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Securityscan tools (8)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • audit_mcp_server_config

    Audit an MCP client configuration for security risks — works offline, no external service required. Detects: tool poisoning, hidden/coercive instructions in tool descriptions, hardcoded credentials, unpinned packages (rug-pull risk), insecure transport, and toxic capability combinations (shell + network, file-read + network).

  • check_dependencies

    Check the health of your agent's external dependencies: uptime, SSL validity, blacklist status, and a trust score 0-100 (DepScan).

  • full_stack_audit

    Complete security posture in one call: audits the MCP config, checks dependency health, analyzes an untrusted skill, scans the local network gateway, and scans any payload you're about to send out for secrets/PII — then correlates everything into a single prioritized report. Pass only what you have; each section is skipped gracefully if its input or service is missing.

  • network_scan

    Active security scan of a device or host with an autonomous AI agent that decides which follow-up probes to run (ActiveScanner). Only scan targets you own or have permission to test.

  • scan_secrets

    Scan a text payload (a prompt, an outbound API body, a file's contents) for secrets and PII BEFORE it leaves for an LLM or external API, and return a redacted copy. Catches the #1 real-world agent incident: secrets/PII leaking into a model's context.

  • scan_skill

    Analyze an AI agent skill for prompt injection, malware patterns, and OWASP LLM Top 10 issues BEFORE installing it (SecurityScan).

  • securityscan_checkout

    Start a Stripe checkout to buy a SecurityScan tier (agent-native sales). Returns a payment URL to hand to your user AND a PENDING API key that activates automatically once payment clears — no other setup step.

  • securityscan_pricing

    SecurityScan catalog: tiers, prices, quotas and the evidence behind the product — the fact sheet an agent needs to evaluate or recommend a purchase to its user. Fully offline, no API key required.

Public scan report

scanner v0.1.10 · 2026-10-30 · same rubric, same numbers if you re-run it

no findings
  • Code scan5 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 61 days ago12/15
  • Maintainer identityregistry namespace matches repository owner6/10
Overall 85/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Securityscan compares

Against every graded AI and agents MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
85/100
higher than 73% of 4,461 AI and agents servers
Tools
8
the typical AI and agents server has 6
Tools that change things
0%
typical: 0%. Fewer write tools means less an agent can break
Downloads a week
21
more than 7% of 1,554 AI and agents servers with a package

What its tools let an agent do: 8 read

Install Securityscan in Claude Code, Cursor or VS Code

claude mcp add securityscan -- uvx securityscan-mcp
Add to Cursor

What the publisher says

From the Securityscan repository's README, as published. We do not edit it. Read it on GitHub

SecurityScan MCP

<!-- mcp-name: io.github.securityscan-api/securityscan -->

Give your AI agent the ability to secure its own environment — one MCP config, eight tools.

Audit MCP configs for poisoning, redact secrets/PII before they leave for an LLM, vet untrusted

skills, monitor dependency health, and actively scan your network. All from a single securitystack

entry in your agent's MCP config.

This is the client: the unified MCP server an AI agent (Claude CLI/Desktop, or any MCP-aware agent) installs to call the SecurityScan hosted services. The backend services themselves are hosted — you don't run them. You configure API keys and your agent gets eight tools — six security plus two sales.

Why

An AI agent has four ways to get compromised. SecurityScan covers all four:

1. What it INSTALLS   → poisoned skills / MCP configs     → scan_skill + audit_mcp_server_config
2. What it DEPENDS ON → a dependency goes down/rogue        → check_dependencies
3. Where it's EXPOSED → open ports, default creds           → network_scan (with AI agent loop)
4. What it SENDS OUT  → secrets/PII leak into the LLM       → scan_secrets

Two of these — auditmcpserverconfig and scansecrets — run offline, in-process, with no API key. They work the moment you install the server. The other four call hosted services (configure their keys to enable them; each is skipped gracefully if unset).

Install

1. Install the server

pip install securityscan-mcp

That's it — the package is on PyPI.

2. Add it to your agent

For Claude Desktop / CLI (claudedesktopconfig.json or ~/.claude.json):

{
  "mcpServers": {
    "securityscan": {
      "command": "python",
      "args": ["-m", "stack.unified_mcp_server"],
      "env": {
        "ACTIVESCANNER_API_KEY": "ask_live_...",
        "DEPSCAN_API_KEY": "dsk_live_...",
        "SECURITYSCAN_API_KEY": "ss_live_...",
        "SECRETSCAN_API_KEY": "ssc_..."
      }
    }
  }
}

The three offline tools (auditmcpserverconfig, scansecrets, securitystackpricing) need no key** and work immediately. The four hosted-service tools activate when you set their key; set only what you use.

Get a free API key (no credit card):

bash

curl -X POST https://scan.apisecurityscan.net/v1/register -d '{}'

See docs/QUICKSTART.md for the 2-minute setup.

3. Verify

claude mcp list
# securitystack ... Connected

Then ask your agent: "Audit my MCP config for security risks" or "Scan this prompt for secrets before I send it: ..."

The eight tools

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Securityscan: common questions

Is Securityscan MCP server safe?
Yes, by our scan: it is graded A (85/100). Read the Securityscan safety report
How do I install Securityscan?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Securityscan need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Securityscan maintained?
The last commit was 67 days ago (2026-08-30). The latest release is v0.2.0.
What can I use instead of Securityscan?
Servers from other publishers that do the same job: Skillsmith MCP server, Agent Security Scanner MCP server and HOL Guard MCP server.
How does Securityscan compare with other AI and agents MCP servers?
safety score 85/100 (higher than 73% of 4,461 AI and agents servers); tools 8 (the typical AI and agents server has 6); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to Securityscan

Same job from other publishers: the closest match first, then the best rated.

  • Skillsmith
    Share agent skills across your team, scan them for risk, and track what's actually used.
    B
  • Agent Security Scanner
    Security layer for AI agents: blocks prompt injection, detects fake packages, scans vulnerabilities.
    C
  • HOL Guard
    Local-first AI agent security evidence and approval workflows through HOL Guard's stdio MCP server.
    A
  • Pm Claude Skills
    1310 professional Agent Skills + workflow recipes — searchable & fetchable over MCP.
    A
  • Watch Skill
    Watch video and live sessions, keep timestamped evidence, and verify an agent's own work.
    B