SecScan

Measured conclusion: Deep-tested. L2 outcome: tools_ok.

Scan, monitor and fix a live web app from your editor: graded security reports with fix prompts.

Add to your agent

Copy this into your MCP client config:

{
  "mcpServers": {
    "SecScan": {
      "url": "https://secscan.us/api/mcp",
      "transport": "streamable-http"
    }
  }
}

Measured tools (12)

• scan_url

  Start a SecScan security scan of a web application the user owns or is authorised to test. Returns a scan_id; most scans finish in under a minute — then call get_scan_status with wait_seconds, or get_report. Active tests (injection, XSS, SSRF…) run only on domains the user has verified; others get passive checks. Optionally also reads a GitHub repository's source (github_repo): any public one, or a private one the user connected at secscan.us. That only contacts GitHub, never the site. Each scan uses one of the user's free scans, plan scans or credits.

  Parameters:

  • url (required) — string — The URL to scan, e.g. https://example.com
  • github_repo — string — Optional GitHub repository to read, e.g. https://github.com/owner/repo. Public, or private if the user connected it under Connect GitHub on secscan.us.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world yes

• get_scan_status read-only

  Status of a scan (queued, scanning, analyzing, complete, failed). With wait_seconds (max 60) it waits for the scan to finish and returns the full report as soon as it does.

  Parameters:

  • scan_id (required) — string — The scan_id returned by scan_url
  • wait_seconds — integer — Wait up to this long for the scan to finish

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world not declared

• get_report read-only

  The finished report for a scan: grade, what the scan tested and what it skipped (a clean grade says nothing about skipped areas, so say so), prioritised findings with fixes and evidence, and a fix prompt written for the user's AI editor. Findings come 25 per page, most severe first — pass offset for the next page, or min_severity (e.g. "high") to focus on what matters most.

  Parameters:

  • scan_id (required) — string — The scan_id returned by scan_url or list_recent_scans
  • limit — integer — Findings per page (default 25, max 50)
  • offset — integer — Skip this many findings, for the next page
  • min_severity — string — Only findings at this severity or worse, e.g. "high"

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world not declared

• list_recent_scans read-only

  The user's most recent scans with their status, newest first.

  Parameters:

  • limit — integer

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world not declared

• list_verified_domains read-only

  Domains the user has proved they own. Only these receive active testing (injection, XSS, SSRF, access control); others get passive checks. Verify more at https://secscan.us/domains.

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world not declared

• get_account read-only

  How many scans the user can still run — free scans, plan scans and credits — and their plan. Check this before starting several scans.

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world not declared

• start_domain_verification

  Begin proving the user owns a domain, which unlocks active tests (injection, XSS, SSRF, access control) on its scans. Returns a file to publish on the site, or a DNS TXT record — an editor can usually add the file to the codebase and deploy it. Then call check_domain_verification. Calling it again returns the same token, so a record already published stays valid.

  Parameters:

  • domain (required) — string — The domain, e.g. example.com or https://example.com

  Hints: read-only not declared · destructive not declared · idempotent no · open-world not declared

• check_domain_verification

  Check whether the file or DNS record from start_domain_verification is live. On success the domain is verified and its next scan includes active tests. DNS changes can take a few minutes.

  Parameters:

  • domain (required) — string — The domain passed to start_domain_verification

  Hints: read-only not declared · destructive not declared · idempotent yes · open-world yes

• list_monitors read-only

  Sites under continuous monitoring: latest grade, last and next scan, uptime check, CVE alerts, new problems in the last scan and certificate expiry. Use the monitor id with monitor_scan_now.

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world not declared

• add_monitor

  Put a site the user owns under continuous monitoring: hourly uptime checks, CVE matching, certificate alerts and regular rescans. Runs a full baseline scan straight away, which uses one of the user's scans exactly as in the app (free for plan holders). Returns the baseline scan_id for get_scan_status.

  Parameters:

  • url (required) — string — The site to monitor, e.g. https://example.com

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world yes

• monitor_scan_now

  Run a full scan of a monitored site now instead of waiting for its schedule — e.g. to confirm a fix. Free for plan holders; otherwise uses one of the user's scans, as in the app. Takes the monitor id from list_monitors.

  Parameters:

  • monitor_id (required) — string — The monitor id from list_monitors or add_monitor

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world yes

• dismiss_finding destructive

  Mark a finding as a false positive for this site, so future scans of it stop reporting it — the same as Dismiss in the app, and undoable there. ONLY use this after the user has confirmed the finding is wrong; never dismiss a real problem to improve a grade.

  Parameters:

  • scan_id (required) — string — The scan whose report contains the finding
  • finding_name (required) — string — The finding's name exactly as get_report shows it

  Hints: read-only not declared · destructive yes · idempotent not declared · open-world not declared

Publisher website

Measured by MCPYP probing. Untested fields are omitted, never estimated. Listing is always free; MCPYP never proxies calls or stores user tokens.