Skip to content
Secscan logo

Secscan MCP server

Which MCP servers are Secscan's own, from the official registry and from asking its own domain, whether they answer, and what they offer. A program checked each of these, nobody copied them from a product page.

read 2026-10-26

← Back to Secscan

Whose server it is
  • Registry nameus.secscan/secscanverified in the MCP registry

The registry name sits under secscan.us. The registry only lets a publisher use that namespace after proving control of the domain through DNS or HTTP.

When we asked itchecked 2026-10-26
  • Stateanswerschecked 2026-10-26
  • Tools12
  • Server calls itselfsecscan
  • Server version1.1.0
  • Protocol version2025-06-18

On 2026-10-26 the server answered initialize and tools/list without a sign-in. First answer in 46 ms.

Should an agent connect itNot proven either way yet
  • Whether its tools do the product's job has not been judged yet.
  • Checked on 1 of the 7 days it takes to judge reliability.

Once connected

  • add_monitor change data without a sign-in: anyone with the address can call them.

Said by rules from the measurements above. The likely first call is a model's pick from the tool list; read its description before relying on it.

Measured dailydaily checks: 1, the first on 2026-10-27
  • INITE MCP scoreafter a weeka score needs 7 daily checks: 1 so far
  • Answeredmeasuring1 of the 7 daily checks it takes to print a share
  • Median first answer108 ms
  • Space in an agent's context≈ 1,726 tokensthe definitions of all its tools (12), which an agent carries on every turn
  • Tool definitionsA · 92 of 100
  • Typed results0 of 12 toolsdeclared outputSchema: results come typed, read once
  • Parameters without a description: in 1 of 12
  • Not saying whether it only reads or can destroy: 5 of 12

Worth a look

  • Tools that change data, on a server that answers without a sign-in: add_monitor

A program checks the server once a day: initialize and tools/list, no model. Tokens are the definitions' length at about four characters a token. The grade averages six checks of every tool's name, description, schema and annotations; it says how well the tools are described, not whether they work. The score weighs what was measured and nothing else: answering (25%), doing the product's job (25%), definitions (20%), context (10%), use (10%) and how readily a client connects (10%). A part that was not measured is left out, and a hidden instruction caps the score at 40. The state of vendors' MCP servers: method and numbers →

Tools it offers12 tools · read 2026-10-26
  • scan_url

    Start a SecScan security scan of a web application the user owns or is authorised to test. Returns a scan_id; most scans finish in under a minute — then call get_scan_status with wait_seconds, or get_report. Active tests (injection, XSS…

  • get_scan_status

    Status of a scan (queued, scanning, analyzing, complete, failed). With wait_seconds (max 60) it waits for the scan to finish and returns the full report as soon as it does.

  • get_report

    The finished report for a scan: grade, what the scan tested and what it skipped (a clean grade says nothing about skipped areas, so say so), prioritised findings with fixes and evidence, and a fix prompt written for the user's AI editor…

  • list_recent_scans

    The user's most recent scans with their status, newest first.

  • list_verified_domains

    Domains the user has proved they own. Only these receive active testing (injection, XSS, SSRF, access control); others get passive checks. Verify more at https://secscan.us/domains.

  • get_account

    How many scans the user can still run — free scans, plan scans and credits — and their plan. Check this before starting several scans.

  • start_domain_verification

    Begin proving the user owns a domain, which unlocks active tests (injection, XSS, SSRF, access control) on its scans. Returns a file to publish on the site, or a DNS TXT record — an editor can usually add the file to the codebase and…

  • check_domain_verification

    Check whether the file or DNS record from start_domain_verification is live. On success the domain is verified and its next scan includes active tests. DNS changes can take a few minutes.

  • list_monitors

    Sites under continuous monitoring: latest grade, last and next scan, uptime check, CVE alerts, new problems in the last scan and certificate expiry. Use the monitor id with monitor_scan_now.

  • add_monitor

    Put a site the user owns under continuous monitoring: hourly uptime checks, CVE matching, certificate alerts and regular rescans. Runs a full baseline scan straight away, which uses one of the user's scans exactly as in the app (free for…

  • monitor_scan_now

    Run a full scan of a monitored site now instead of waiting for its schedule — e.g. to confirm a fix. Free for plan holders; otherwise uses one of the user's scans, as in the app. Takes the monitor id from list_monitors.

  • dismiss_finding

    Mark a finding as a false positive for this site, so future scans of it stop reporting it — the same as Dismiss in the app, and undoable there. ONLY use this after the user has confirmed the finding is wrong; never dismiss a real problem…

How to connect

Add the server to your MCP client config. Claude Desktop, Cursor and most other clients read this shape:

{
  "mcpServers": {
    "secscan": {
      "type": "http",
      "url": "https://secscan.us/api/mcp"
    }
  }
}

Add it

Claude Code, in a terminal

claude mcp add --transport http secscan https://secscan.us/api/mcp

Add to CursorAdd to VS Code

claude.ai, ChatGPT and other clients: add https://secscan.us/api/mcp as a custom connector in the settings.

Each line is something a program found when it went looking: the registry entry, the server's own answer, a spec that parses. A missing line means we did not find it, not that it does not exist.