PCI ASV Scan & PCI Compliance Scanning MCP server

• Registry namecom.serverscan/mcpverified in the MCP registry

The registry name sits under serverscan.com. The registry only lets a publisher use that namespace after proving control of the domain through DNS or HTTP.

• Stateanswerschecked 2026-10-22
• Tools4
• Server calls itselfserverscan
• Server version1.0.0
• Protocol version2025-06-18

On 2026-10-22 the server answered initialize and tools/list without a sign-in. First answer in 175 ms.

• Whether its tools do the product's job has not been judged yet.

Said by rules from the measurements above. The likely first call is a model's pick from the tool list; read its description before relying on it.

• INITE MCP score100 of 100answers 100 · definitions 100 · context 100 · connects 100
• Answered100% of days12 of 12 daily checks
• Median first answer236 ms
• Space in an agent's context≈ 1,061 tokensthe definitions of all its tools (6), which an agent carries on every turn
• Tool definitionsA · 100 of 100
• Typed results0 of 6 toolsdeclared outputSchema: results come typed, read once

• Every tool passes all six checks.

A program checks the server once a day: initialize and tools/list, no model. Tokens are the definitions' length at about four characters a token. The grade averages six checks of every tool's name, description, schema and annotations; it says how well the tools are described, not whether they work. The score weighs what was measured and nothing else: answering (25%), doing the product's job (25%), definitions (20%), context (10%), use (10%) and how readily a client connects (10%). A part that was not measured is left out, and a hidden instruction caps the score at 40. The state of vendors' MCP servers: method and numbers →

• get_pricing

  Current prices for ServerScan PCI ASV scanning (per domain or IP address), payment page monitoring and penetration testing, read live from the store, with what each plan includes and the refund terms.

• do_i_need_an_asv_scan

  Says whether a merchant's PCI DSS self-assessment questionnaire (SAQ) requires quarterly external scans by an Approved Scanning Vendor, under PCI DSS v4.0.1, and what to scan. Pass the SAQ type, or "unsure" to get every SAQ with who it is…

• check_payment_page

  Runs ServerScan's free one-off check of a payment or checkout page: TLS, security headers, the HTTP to HTTPS redirect, which scripts load and from where, and whether third-party scripts carry an integrity hash (PCI DSS 6.4.3 and 11.6.1)…

• start_order

  Returns a link to ServerScan's signup page with the plan picked and the domain filled in, for the person to open, check and pay. Creates nothing and charges nothing. For a penetration test it returns the quote request page.