ScanLabsAI MCP server

• Registry namecom.scanlabsai/scannerverified in the MCP registry

The registry name sits under scanlabsai.com. The registry only lets a publisher use that namespace after proving control of the domain through DNS or HTTP.

• Stateanswerschecked 2026-10-25
• Tools8
• Server calls itselfscanlabsai
• Server version1.0.0
• Protocol version2025-06-18

On 2026-10-25 the server answered initialize and tools/list without a sign-in. First answer in 91 ms.

• Its tools do every use case we checked: Scan a live website for OWASP Top 10 issues; Review SSL and security header configuration; Get prioritised fixes to work through with Claude.
• Checked on 2 of the 7 days it takes to judge reliability.

Said by rules from the measurements above. The likely first call is a model's pick from the tool list; read its description before relying on it.

• INITE MCP scoreafter a weeka score needs 7 daily checks: 2 so far
• What an agent can do with it3 of 3 use cases
• Use13 npm downloads a week
• Answeredmeasuring2 of the 7 daily checks it takes to print a share
• Median first answer170 ms
• Space in an agent's context≈ 1,107 tokensthe definitions of all its tools (8), which an agent carries on every turn
• Tool definitionsB · 83 of 100
• Typed results0 of 8 toolsdeclared outputSchema: results come typed, read once

• Not saying whether it only reads or can destroy: 8 of 8

A program checks the server once a day: initialize and tools/list, no model. Tokens are the definitions' length at about four characters a token. The grade averages six checks of every tool's name, description, schema and annotations; it says how well the tools are described, not whether they work. The score weighs what was measured and nothing else: answering (25%), doing the product's job (25%), definitions (20%), context (10%), use (10%) and how readily a client connects (10%). A part that was not measured is left out, and a hidden instruction caps the score at 40. The state of vendors' MCP servers: method and numbers →

• scan_website

  Run a ScanLabsAI security scan against a website and return a full Markdown vulnerability report (grouped by severity, with descriptions and remediation) that you can analyse, act on, and the user can save as security-report.md. Checks…

• scan_agent

  Red-team an AI agent for security weaknesses — prompt injection, system-prompt leakage, sensitive-data disclosure, unsafe output handling and excessive agency — mapped to the OWASP LLM Top 10, and return a Markdown report. This is…

• compliance_report

  Generate a website compliance report — the same automated assessment the ScanLabsAI agency portal runs — covering GDPR/CCPA privacy, WCAG 2.1 AA accessibility, PCI DSS 4.0 payment security and general standards. Returns an overall score…

• get_fix_guidance

  Get detailed, step-by-step remediation guidance for a specific vulnerability or security issue (e.g. "missing Content-Security-Policy header", "SQL injection", a CVE id). Returns actionable fixes.

• lookup_cves

  Look up recent CVEs from the NIST NVD feed, optionally filtered by keyword. Returns id, severity, score and summary.

• get_pricing

  Get ScanLabsAI pricing: the free-first-scan policy and AI credit packs.

• check_credits

  Check the signed-in account's AI credit balance. Requires a ScanLabsAI API key in the MCP connection (Authorization: Bearer slai_...). Create one at https://scanlabsai.com/mcp.

• buy_credits

  Get a secure Stripe checkout link to buy an AI credit pack for the signed-in account. Requires a ScanLabsAI API key in the MCP connection. Credits are added automatically once payment completes. Packs: starter (5), pro (15), agency (50).