Connect

8 clients · secrets stay placeholders

JSON (mcpServers)Claude CodeCodexOpenCodeCursorVS CodeGemini CLIGoose

{
  "mcpServers": {
    "compuute-scan-api": {
      "type": "http",
      "url": "https://scan.compuute.se/mcp/"
    }
  }
}

claude mcp add --transport http compuute-scan-api https://scan.compuute.se/mcp/

[mcp_servers.compuute-scan-api]
url = "https://scan.compuute.se/mcp/"

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "compuute-scan-api": {
      "type": "remote",
      "url": "https://scan.compuute.se/mcp/",
      "enabled": true
    }
  }
}

{
  "mcpServers": {
    "compuute-scan-api": {
      "type": "http",
      "url": "https://scan.compuute.se/mcp/"
    }
  },
  "deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=compuute-scan-api&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vc2Nhbi5jb21wdXV0ZS5zZS9tY3AvIn0%3D"
}

{
  "servers": {
    "compuute-scan-api": {
      "type": "http",
      "url": "https://scan.compuute.se/mcp/"
    }
  }
}

{
  "mcpServers": {
    "compuute-scan-api": {
      "httpUrl": "https://scan.compuute.se/mcp/"
    }
  }
}

extensions:
  "compuute-scan-api":
    enabled: true
    name: "compuute-scan-api"
    type: streamable_http
    uri: "https://scan.compuute.se/mcp/"
    timeout: 300

Quality 76 / 100good

protocol75 · weight 25

warn
protocol.modernnewest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
n/a
protocol.statelessonly applies to 2026-07-28 servers
pass
protocol.transportstreamable HTTP
n/a
protocol.list_ttlonly applies to 2026-07-28 servers

authorizationn/a · weight 15

n/a
auth.prm, auth.as_metadata, auth.cimdno remote uses OAuth
n/a
auth.secret_in_urlno templated URL

tool hygiene64 · weight 30

pass
tools.descriptionsevery tool has a description
warn
tools.description_length1 tools have descriptions over 1,024 characters, which crowds the context
pass
tools.schemasevery tool has an object input schema
fail
tools.annotationsno tool declares readOnlyHint or destructiveHint, so clients cannot tell safe calls from risky ones
fail
tools.directory_hintsno tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: scan_mcp_server (readOnlyHint, destructiveHint, idempotentHint, openWorldHint)
pass
tools.token_costabout 999 tokens to load every tool
pass
tools.api_dumptools are not a one-to-one API dump

stability100 · weight 15

pass
stability.changesno tool changes in 30 days
pass
stability.rug_pullno tool changed its meaning under the same name

dependenciesn/a · weight 15

n/a
deps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI package

1 tools, about 999 tokens to load them all · tool set d3011d5b6c8c · checked 2026-10-19 16:53 UTC

Tool changes

No tool definition changes recorded. A server's first observation is its baseline; later probes record what changes.

Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.

Trust 90 / 100

provenance90

liveness100

freshness65

hygiene100

+repository +namespace-matches-repo +website +reachable +uptime-100% ~updated-149d-ago

Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.

Endpoints

remote	auth	reachable	uptime 30d	p50	protocol	last ok
`https://scan.compuute.se/mcp/` streamable-http	none	yes	100%	521 ms	2025-11-25	2026-10-19

Tools (1)

scan_mcp_server Scan a public GitHub MCP-server repository for security issues. Clones the repo (shallow, <60s, <200 MB), runs compuute-scan v0.6.2 in static analysis mode (no code execution from the target), and returns a structured report with severity counts, a 0-100 score, and the 10 most severe findings. WHEN TO USE: - Before connecting to an unknown MCP server discovered via Anthropic Registry, Smithery, mcp.so, or a Discord recommendation. - Before installing a third-party MCP-server package into a production pipeline. - As part of an agent's pre-commit / pre-deploy due-diligence step when adding new dependencies. - As one input to a multi-source trust evaluation (combine with publisher reputation, package install count, last-update recency). WHEN NOT TO USE: - For private repos. Use the on-prem CLI instead: `npx compuute-scan ./path-to-private-repo` - For deep exploitability assessment of a specific code path. This is pattern matching, not dataflow analysis. Book a manual L2-L4 audit at https://compuute.se/audit for that depth. - For non-GitHub hosts (GitLab, Bitbucket, self-hosted). v1 supports github.com only. - For repos > 200 MB or clone time > 60s. The endpoint returns a 413 or 504 in those cases — fall back to local CLI. EXPECTED RESPONSE TIME: - Median: ~1-2 seconds for small repos (<100 files). - p99: ~10 seconds for medium repos. - Hard timeout at clone=60s, scan=120s combined. EXPECTED COST: - Free tier in MVP. Future Pro tier may charge per-scan or per-month. DATA FRESHNESS: - Scanner version is reported in response.scanner.version. - L1 rule set freshness reflects compuute-scan releases — see github.com/Compuute/compuute-scan/CHANGELOG.md for the latest CVE and threat-intel response timeline. EXAMPLES: Example 1 — scan an MCP server you're evaluating: github_url = "https://github.com/modelcontextprotocol/servers" → score: 0, summary: {critical: 1, high: 94, medium: 22} → top_findings include SSRF, eval, etc. → recommendation: "AVOID — 1 critical and 94 high finding(s)..." Example 2 — scan a clean reference implementation: github_url = "https://github.com/microsoft/azure-devops-mcp" → score: 90+, summary: {critical: 0, high: 1} → recommendation: "REVIEW — 1 high finding(s)..." Example 3 — scan your own dev MCP-server before publishing: github_url = "https://github.com/yourorg/your-mcp" → audit your own surface before others install it OUTPUT FIELDS (stable schema): - repo_url (str): canonical URL of the scanned repo. - score (int): 0-100, higher safer. Coarse summary, not a precision claim. - summary (object): {critical, high, medium, low, info, files_scanned}. - recommendation (str): action guidance derived from severity counts. - findings_count (int): total raw findings (may include false positives). - top_findings (list): up to 10 most severe, each with {id, title, severity, file, line, owasp, cwe}. - l0_discovery (object): MCP transport, tool count, dependency pinning. - performance (object): clone_seconds, scan_seconds, repo_size_bytes. - scanner (object): {name, version, layers_covered}. - _disclaimer (str): MANDATORY triage disclaimer. Read it. Args: github_url: Public GitHub HTTPS URL (e.g. https://github.com/org/repo). Must be public and < 200 MB. v1 is github.com only. Returns: Structured scan result. On error, returns {"error": code, "message": ...} with HTTP-style code (invalid_url, clone_failed, scan_timeout, etc.).

Schemas: list_tools.

Similar MCP servers

More from io.github.Compuute

Official server.json

{
  "name": "io.github.Compuute/compuute-scan-api",
  "title": "Compuute MCP Security Scanner",
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "remotes": [
    {
      "url": "https://scan.compuute.se/mcp/",
      "type": "streamable-http"
    }
  ],
  "version": "0.3.0",
  "repository": {
    "url": "https://github.com/Compuute/compuute-scan-api",
    "source": "github"
  },
  "websiteUrl": "https://scan.compuute.se",
  "description": "Scan any public GitHub MCP-server repo for security issues. 37 MCP-specific L1 rules, 8 languages."
}