ScanLabsAI Security Scanner

Measured conclusion: Deep-tested. L2 outcome: tools_ok.

Scan a website for vulnerabilities: OWASP Top 10, CVEs, SSL, headers - with plain-English fixes

Add to your agent

Copy this into your MCP client config:

{
  "mcpServers": {
    "ScanLabsAI Security Scanner": {
      "url": "https://scanlabsai.com/api/mcp",
      "transport": "streamable-http"
    }
  }
}

Measured tools (8)

• scan_website

  Run a ScanLabsAI security scan against a website and return a full Markdown vulnerability report (grouped by severity, with descriptions and remediation) that you can analyse, act on, and the user can save as security-report.md. Checks OWASP Top 10, CVEs, SSL/TLS, security headers and DNS. Use deep=true for a comprehensive scan (40,000+ vectors, slower). Only scan sites the user is authorised to test.

  Parameters:

  • url (required) — string — The website URL to scan, e.g. https://example.com
  • deep — boolean — Run a deep scan (comprehensive, slower). Defaults to false.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• scan_agent

  Red-team an AI agent for security weaknesses — prompt injection, system-prompt leakage, sensitive-data disclosure, unsafe output handling and excessive agency — mapped to the OWASP LLM Top 10, and return a Markdown report. This is agent-to-agent scanning: use it to assess another agent from here. Two target kinds are supported: kind="openai" for an OpenAI-compatible chat-completions endpoint, or kind="mcp" for an MCP server (its tool manifest is audited for tool-poisoning and over-broad capabilities). Requires a ScanLabsAI API key in the connection; each agent scan uses 5 AI credits. Probing is active and adversarial — only scan agents you own or are authorised to test.

  Parameters:

  • kind (required) — string — Target type: "openai" for a chat-completions endpoint, "mcp" for an MCP server.
  • endpoint (required) — string — The agent endpoint URL (chat-completions URL, or MCP server URL).
  • deep — boolean — Run deeper probes (jailbreak + resource-exhaustion). Defaults to false.
  • model — string — Model name for OpenAI-compatible endpoints, e.g. gpt-4o-mini.
  • apiKey — string — Optional bearer token / API key the target agent requires. Sent to the target only; not stored.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• compliance_report

  Generate a website compliance report — the same automated assessment the ScanLabsAI agency portal runs — covering GDPR/CCPA privacy, WCAG 2.1 AA accessibility, PCI DSS 4.0 payment security and general standards. Returns an overall score, per-category scores and the failing/at-risk checks with recommendations, as Markdown. Requires a ScanLabsAI API key in the connection; costs 1 AI credit per report. Only run against sites you are authorised to assess.

  Parameters:

  • url (required) — string — The website URL to assess for compliance, e.g. https://example.com

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• get_fix_guidance

  Get detailed, step-by-step remediation guidance for a specific vulnerability or security issue (e.g. "missing Content-Security-Policy header", "SQL injection", a CVE id). Returns actionable fixes.

  Parameters:

  • issue (required) — string — The vulnerability, finding title, or CVE id to fix.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• lookup_cves

  Look up recent CVEs from the NIST NVD feed, optionally filtered by keyword. Returns id, severity, score and summary.

  Parameters:

  • limit — number — Max results (1-25). Defaults to 10.
  • keyword — string — Optional keyword, e.g. "wordpress" or "openssl".

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• get_pricing

  Get ScanLabsAI pricing: the free-first-scan policy and AI credit packs.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• check_credits

  Check the signed-in account's AI credit balance. Requires a ScanLabsAI API key in the MCP connection (Authorization: Bearer slai_...). Create one at https://scanlabsai.com/mcp.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• buy_credits

  Get a secure Stripe checkout link to buy an AI credit pack for the signed-in account. Requires a ScanLabsAI API key in the MCP connection. Credits are added automatically once payment completes. Packs: starter (5), pro (15), agency (50).

  Parameters:

  • pack — string — Pack id: starter, pro, or agency. Defaults to pro.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

Publisher website

Measured by MCPYP probing. Untested fields are omitted, never estimated. Listing is always free; MCPYP never proxies calls or stores user tokens.