Skip to content
SimplyScan logo

SimplyScan MCP server

Which servers in the official MCP registry are SimplyScan's own, whether they answer, and what they offer. A program checked each of these, nobody copied them from a product page.

read 2026-10-19

← Back to SimplyScan

Whose server it is
  • Registry nameio.simplyscan/simplyscanverified in the MCP registry

The registry name sits under simplyscan.io. The registry only lets a publisher use that namespace after proving control of the domain through DNS or HTTP.

When we asked itchecked 2026-10-19
  • Stateanswerschecked 2026-10-19
  • Tools8
  • Server calls itselfsimplyscan
  • Server version1.0.0
  • Protocol version2025-06-18

On 2026-10-19 the server answered initialize and tools/list without a sign-in. First answer in 2019 ms.

Should an agent connect itNot proven either way yet
  • Its tools do Scan a live app URL for exposed API keys, but not Check Supabase tables for missing row level security; Share a PDF security report with a team.
  • Checked on 3 of the 7 days it takes to judge reliability.

Once connected

  • For "Scan a live app URL for exposed API keys", the likely first call is scan_website.

Said by rules from the measurements above. The likely first call is a model's pick from the tool list; read its description before relying on it.

Measured dailydaily checks: 3, the first on 2026-10-19
  • INITE MCP scoreafter a weeka score needs 7 daily checks: 3 so far
  • What an agent can do with it1 of 3 use cases
  • Answeredmeasuring3 of the 7 daily checks it takes to print a share
  • Median first answer2370 ms
  • Space in an agent's context≈ 976 tokensthe definitions of all its tools (8), which an agent carries on every turn
  • Tool definitionsA · 98 of 100
  • Typed results0 of 8 toolsdeclared outputSchema: results come typed, read once
  • Parameters without a description: in 1 of 8

What an agent can do with it

  • can do · Scan a live app URL for exposed API keys
  • cannot · Check Supabase tables for missing row level security
  • cannot · Share a PDF security report with a team

Each of the product's use cases, put to Jev against this server's tool list: can an agent do it with these tools?

Worth a look

None of the five warning signs in these definitions.

A program checks the server once a day: initialize and tools/list, no model. Tokens are the definitions' length at about four characters a token. The grade averages six checks of every tool's name, description, schema and annotations; it says how well the tools are described, not whether they work. The score weighs what was measured and nothing else: answering (30%), doing the product's job (25%), definitions (20%), context (10%) and use (15%). A part that was not measured is left out, and a hidden instruction caps the score at 40. The state of vendors' MCP servers: method and numbers →

Tools it offers8 tools · read 2026-10-19
  • scan_website

    Run a SimplyScan Security Engine security & speed scan (Pro with an entitled API key; otherwise free) of a deployed web app URL. Returns a 0-100 score and findings (exposed secrets, missing Supabase RLS, frontend leaks, speed issues)…

  • scan_local_code

    Send selected editor file contents to the SimplyScan Security Engine's deterministic repository rules. Requires a Pro API key. Source leaves the editor, is processed in memory, and is not retained; masked findings are saved in the private…

  • check_security_headers

    Grade a URL's HTTP security headers (CSP, HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy, COOP, COEP) A-F.

  • check_ai_visibility

    AEO check: whether AI answer engines (ChatGPT/GPTBot, Claude, Perplexity, Google-Extended, etc.) can crawl and cite the site, plus llms.txt and structured-data signals.

  • check_seo

    On-page SEO audit of a URL: title, meta description, H1, canonical, indexability, Open Graph, structured data, image alt coverage, sitemap. Returns an A-F grade.

  • check_ssl

    Inspect a domain's SSL/TLS certificate: issuer, expiry, protocol, and flags for expiring/self-signed/mismatched certs.

  • check_email_security

    Check a domain's email authentication: SPF, DKIM (common selectors), and DMARC policy. Flags spoofable domains.

  • check_exposed_files

    Probe a site for accidentally exposed high-risk files (.env, .git/config, backups, etc.). Reports HTTP status only, never file contents.

How to connect

Add the server to your MCP client config. Claude Desktop, Cursor and most other clients read this shape:

{
  "mcpServers": {
    "simplyscan": {
      "type": "http",
      "url": "https://api.simplyscan.io/mcp"
    }
  }
}

Add it

Claude Code, in a terminal

claude mcp add --transport http simplyscan https://api.simplyscan.io/mcp

Add to CursorAdd to VS Code

claude.ai, ChatGPT and other clients: add https://api.simplyscan.io/mcp as a custom connector in the settings.

Each line is something a program found when it went looking: the registry entry, the server's own answer, a spec that parses. A missing line means we did not find it, not that it does not exist.