Connect

8 clients · secrets stay placeholders

JSON (mcpServers)Claude CodeCodexOpenCodeCursorVS CodeGemini CLIGoose

{
  "mcpServers": {
    "scanner": {
      "type": "http",
      "url": "https://scanlabsai.com/api/mcp"
    }
  }
}

claude mcp add --transport http scanner https://scanlabsai.com/api/mcp

[mcp_servers.scanner]
url = "https://scanlabsai.com/api/mcp"

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "scanner": {
      "type": "remote",
      "url": "https://scanlabsai.com/api/mcp",
      "enabled": true
    }
  }
}

{
  "mcpServers": {
    "scanner": {
      "type": "http",
      "url": "https://scanlabsai.com/api/mcp"
    }
  },
  "deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=scanner&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vc2NhbmxhYnNhaS5jb20vYXBpL21jcCJ9"
}

{
  "servers": {
    "scanner": {
      "type": "http",
      "url": "https://scanlabsai.com/api/mcp"
    }
  }
}

{
  "mcpServers": {
    "scanner": {
      "httpUrl": "https://scanlabsai.com/api/mcp"
    }
  }
}

extensions:
  "scanner":
    enabled: true
    name: "scanner"
    type: streamable_http
    uri: "https://scanlabsai.com/api/mcp"
    timeout: 300

Quality – / 100not scored

Not scored: fewer than three checks apply, usually because no remote answered a credential-free probe or the server is a local package.

protocol75 · weight 25

warn
protocol.modernnewest supported version is 2025-06-18; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
n/a
protocol.statelessonly applies to 2026-07-28 servers
pass
protocol.transportstreamable HTTP
n/a
protocol.list_ttlonly applies to 2026-07-28 servers

authorizationn/a · weight 15

n/a
auth.prm, auth.as_metadata, auth.cimdno remote uses OAuth
n/a
auth.secret_in_urlno templated URL

tool hygienen/a · weight 30

n/a
tools.descriptions, tools.description_length, tools.schemas, tools.annotations, tools.directory_hints, tools.token_cost, tools.api_dumptool list unknown (behind auth, not probed, or empty)

stabilityn/a · weight 15

n/a
stability.changes, stability.rug_pulltool list unknown

dependencies100 · weight 15

pass
deps.known_vulnsno known advisory in 1 resolved packages
n/a
deps.mcp_sdk_versionthe official MCP SDK is not in the dependency graph
pass
deps.resolvable@scanlabsai/[email protected] resolved: 1 packages

Tool list unknown · tools last changed 2026-10-19 · checked 2026-10-20 04:09 UTC

Tool changes

2026-10-19buy_creditsremoved
Get a secure Stripe checkout link to buy an AI credit pack for the signed-in account. Requires a ScanLabsAI API key in the MCP connection. Credits are added automatically once payment completes. Packs: starter (5), pro (15), agency (50).
2026-10-19get_pricingremoved
Get ScanLabsAI pricing: the free-first-scan policy and AI credit packs.
2026-10-19lookup_cvesremoved
Look up recent CVEs from the NIST NVD feed, optionally filtered by keyword. Returns id, severity, score and summary.
2026-10-19get_fix_guidanceremoved
Get detailed, step-by-step remediation guidance for a specific vulnerability or security issue (e.g. "missing Content-Security-Policy header", "SQL injection", a CVE id). Returns actionable fixes.
2026-10-19compliance_reportremoved
Generate a website compliance report — the same automated assessment the ScanLabsAI agency portal runs — covering GDPR/CCPA privacy, WCAG 2.1 AA accessibility, PCI DSS 4.0 payment security and general standards. Returns an overall score, per-category scores and the failing/at-risk checks with recommendations, as Markdown. Requires a ScanLabsAI API key in the connection; costs 1 AI credit per report. Only run against sites you are authorised to assess.
2026-10-19scan_agentremoved
Red-team an AI agent for security weaknesses — prompt injection, system-prompt leakage, sensitive-data disclosure, unsafe output handling and excessive agency — mapped to the OWASP LLM Top 10, and return a Markdown report. This is agent-to-agent scanning: use it to assess another agent from here. Two target kinds are supported: kind="openai" for an OpenAI-compatible chat-completions endpoint, or kind="mcp" for an MCP server (its tool manifest is audited for tool-poisoning and over-broad capabilities). Requires a ScanLabsAI API key in the connection; each agent scan uses 5 AI credits. Probing is active and adversarial — only scan agents you own or are authorised to test.
2026-10-19scan_websiteremoved
Run a ScanLabsAI security scan against a website and return a full Markdown vulnerability report (grouped by severity, with descriptions and remediation) that you can analyse, act on, and the user can save as security-report.md. Checks OWASP Top 10, CVEs, SSL/TLS, security headers and DNS. Use deep=true for a comprehensive scan (40,000+ vectors, slower). Only scan sites the user is authorised to test.
2026-10-19check_creditsremoved
Check the signed-in account's AI credit balance. Requires a ScanLabsAI API key in the MCP connection (Authorization: Bearer slai_...). Create one at https://scanlabsai.com/mcp.

Full history: list_changes · trend: quality JSON.

Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.

Trust 80 / 100

no-repository

provenance55

liveness100

freshness85

hygiene80

+dns-namespace +website +reachable +uptime-100% ~updated-36d-ago -no-repository

Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.

Dependencies

@scanlabsai/[email protected] npm0 dependencies, resolved · advisories checked 2026-10-19

No known advisory affects this dependency graph.

Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0. The graph is what a clean install of this version resolves today; nothing was installed or run. How it is checked.

Endpoints

remote	auth	reachable	uptime 30d	p50	protocol	last ok
`https://scanlabsai.com/api/mcp` streamable-http	none	yes	100%	282 ms	2025-06-18	2026-10-19

package	registry	version	runtime	secrets
`@scanlabsai/mcp-server`	npm	1.0.0	–	`SCANLABS_API_KEY`

Tools (0)

No tools observed. Tools appear once a credential-free probe can list them.

Schemas: list_tools.

Similar MCP servers

Official server.json

{
  "name": "com.scanlabsai/scanner",
  "title": "ScanLabsAI Security Scanner",
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "remotes": [
    {
      "url": "https://scanlabsai.com/api/mcp",
      "type": "streamable-http"
    }
  ],
  "version": "1.1.0",
  "packages": [
    {
      "version": "1.0.0",
      "transport": {
        "type": "stdio"
      },
      "identifier": "@scanlabsai/mcp-server",
      "registryType": "npm",
      "environmentVariables": [
        {
          "name": "SCANLABS_API_KEY",
          "format": "string",
          "isSecret": true,
          "description": "Your ScanLabsAI API key from https://scanlabsai.com/mcp. Optional: without it you get one free scan per website."
        }
      ]
    }
  ],
  "websiteUrl": "https://scanlabsai.com",
  "description": "Scan a website for vulnerabilities: OWASP Top 10, CVEs, SSL, headers - with plain-English fixes"
}