{
  "markdown": "# compuute-scan-api\n\n**Scan-as-a-Service for MCP servers.** HTTP + MCP wrapper around [compuute-scan](https://github.com/Compuute/compuute-scan) — the MCP-specific static security scanner. Designed for agent-callable consumption.\n\nPOST a public GitHub repo URL → get a structured security report scored against 38 MCP-specific rules across 8 languages (TS/JS, Python, Go, Rust, C#, Java, Kotlin).\n\n> **Honesty note (read first):** compuute-scan is a **pattern-breadth detector**, not an exploitability oracle. Historic false-positive rate after manual validation is **~90% on raw output** (verified against [modelcontextprotocol/servers](https://github.com/modelcontextprotocol/servers): 138 raw findings → 13 confirmed). Every response carries a `_disclaimer` field stating this explicitly. Use findings as a triage queue, not as a list of confirmed vulnerabilities. See [docs/FP-RATES.md](docs/FP-RATES.md) for per-rule transparency.\n\nLive at <https://scan.compuute.se>. Service version reported by `/v1/health`.\n\n---\n\n## Endpoints\n\n### Core scan\n\n| Method | Path | Purpose | Auth |\n|--------|------|---------|------|\n| POST | `/v1/scan` | Scan a public GitHub MCP-server repo (free tier, rate-limited) | none |\n| POST | `/v1/scan/pay` | Same as above via [x402](https://www.x402.org/) micropayment ($0.10 USDC on Base L2) | `X-Payment` header |\n\nPOST `/v1/scan/pay` with no body to read the payment requirements without paying — the request body is optional precisely so discovery probes reach the 402 instead of body validation. Verify with the Coinbase Agentic Wallet CLI:\n\n```bash\nnpx awal x402 details https://scan.compuute.se/v1/scan/pay\n```\n| GET | `/v1/scan/info` | Scanner version + limits + supported ecosystems | none |\n| GET | `/v1/health` | Liveness + scanner-binary availability | none |\n\n### Machine-readable contracts\n\n| Method | Path | Purpose |\n|--------|------|---------|\n| GET | `/openapi.json` | OpenAPI v3 spec with per-field descriptions |\n| GET | `/docs` | Swagger UI for the OpenAPI spec |\n\n### MCP server (live)\n\n| Endpoint | Tool | Transport |\n|----------|------|-----------|\n| `/mcp/` | `scan_mcp_server(github_url)` | Streamable HTTP |\n\nInstall in Claude Code: `claude mcp add compuute-scan --transport http --url https://scan.compuute.se/mcp/`\n\n### Discovery (`/.well-known/`)\n\n| Path | Format | Consumer |\n|------|--------|----------|\n| `/.well-known/agent-card.json` | A2A v1.0 Agent Card (canonical) | A2A protocol clients |\n| `/.well-known/agent.json` | A2A Agent Card (alias) | pre-1.0 A2A clients/crawlers |\n| `/.well-known/ai-plugin.json` | OpenAI plugin manifest | ChatGPT / OpenAI tools |\n| `/.well-known/x402.json` | x402 payment manifest | Coinbase Agent.market crawlers, x402 aggregators |\n| `/.well-known/x402` | Alias of `x402.json` | x402 probes without `.json` suffix |\n| `/llms.txt` | markdown summary | LLM-driven agent-search crawlers (Exa, Perplexity-style) per [llmstxt.org](https://llmstxt.org) |\n| `/robots.txt` | crawler policy | search engines |\n| `/sitemap.xml` | URL index | search engines |\n\n### Example\n\n```bash\ncurl -X POST https://scan.compuute.se/v1/scan \\\n  -H 'Content-Type: application/json' \\\n  -H 'Idempotency-Key: 00000000-0000-0000-0000-000000000001' \\\n  -d '{\"repo_url\": \"https://github.com/modelcontextprotocol/servers\"}'\n```\n\nResponse (truncated):\n\n```json\n{\n  \"repo_url\": \"https://github.com/modelcontextprotocol/servers\",\n  \"scanner\": {\"name\": \"compuute-scan\", \"version\": \"0.6.2\", \"layers_covered\": [\"L0\", \"L1\"]},\n  \"summary\": {\"critical\": 1, \"high\": 94, \"medium\": 22, \"low\": 0, \"files_scanned\": 77},\n  \"score\": 0,\n  \"recommendation\": \"AVOID — 1 critical and 94 high finding(s)...\",\n  \"top_findings\": [...],\n  \"performance\": {\"clone_seconds\": 1.2, \"scan_seconds\": 0.5, \"repo_size_bytes\": 41234},\n  \"_disclaimer\": \"PATTERN MATCH — compuute-scan is a static analyzer...\"\n}\n```\n\n## Agent-shaped API features\n\n| Feature | How |\n|---------|-----|\n| Idempotent retries (24h cache) | `Idempotency-Key` header |\n| HTTP cache | `ETag` + `Cache-Control: public, max-age=1800` |\n| Conditional GET | `If-None-Match` → 304 Not Modified |\n| Rate-limit headers | `X-RateLimit-Limit/Remaining/Reset` |\n| Strict input validation | Pydantic `extra=\"forbid\"`, GitHub-HTTPS-only |\n| OWASP security headers | HSTS / X-Frame-Options / X-Content-Type-Options / CSP / Referrer-Policy / Permissions-Policy |\n| OpenAPI for discovery | `GET /openapi.json` with descriptions on every field |\n| MCP for agent discovery | `/mcp/` exposes `scan_mcp_server` tool |\n| x402 for autonomous purchase | `/v1/scan/pay` returns 402 with USDC/Base payment requirements |\n| Honest framing | Every response carries `_disclaimer` — pattern match, not exploitability claim |\n\n## Pricing\n\n| Tier | Audience | Price |\n|------|----------|-------|\n| Open Source CLI | Indie devs, agent builders | $0 — `npx compuute-scan ./repo` |\n| Hosted API (free) | Agent operators evaluating MCP servers | $0 — `POST /v1/scan`, rate-limited |\n| Hosted API (x402) | Autonomous agents in Agent.market ecosystem | $0.10 USDC/scan — `POST /v1/scan/pay` |\n| MCP Security Audit | Enterprises shipping MCP to production | $5K–$30K SoW |\n| AI Procurement Risk Audit | CFO/CTO/CISO buying enterprise AI capacity | $5K–$15K SoW |\n\nFull breakdown with JSON-LD: <https://compuute.se/pricing>.\n\n## Local development\n\n```bash\npython3 -m venv venv && source venv/bin/activate\npip install -r requirements.txt\nexport COMPUUTE_SCAN_PATH=$HOME/compuute-scan/compuute-scan.js\nuvicorn main:app --reload\n```\n\nx402 payment env vars (all optional locally; `/v1/scan/pay` returns 503 until the wallet is set):\n\n| Var | Purpose | Default |\n|-----|---------|---------|\n| `X402_WALLET_ADDRESS` | Base L2 address receiving USDC | unset (x402 disabled) |\n| `X402_NETWORK` | CAIP-2 network id — `eip155:8453` (Base mainnet) or `eip155:84532` (Base Sepolia) | `eip155:8453` |\n| `X402_PRICE_USD` | Price per scan | `0.10` |\n| `X402_FACILITATOR_URL` | Facilitator base URL | CDP facilitator (serves both networks) |\n| `CDP_API_KEY_ID` / `CDP_API_KEY_SECRET` | CDP API key for facilitator verify/settle auth | unset (verify will be rejected) |\n\n### Rehearsing payments on testnet\n\nSet `X402_NETWORK=eip155:84532` to quote prices in Base Sepolia USDC, which is\nfree from a faucet. The CDP facilitator serves Sepolia too, so a testnet\npayment exercises the real verify/settle path and your real CDP API keys —\nwithout moving real money.\n\nAsset address and EIP-712 domain are selected together per network: Base\nmainnet USDC signs as `\"USD Coin\"`, Base Sepolia as `\"USDC\"`. Mixing them\nfails every signature with an error that looks like a bad API key, which is\nwhy they live in one `NETWORKS` table rather than separate env vars.\n\nMainnet is the default and an unknown value falls back to it, so a typo can\nnever silently ask real agents to pay in worthless testnet USDC. Check which\nmode is live with `curl -s https://scan.compuute.se/v1/health` — the `x402`\nblock reports `network` and `testnet`.\n\n## Tests\n\n```bash\npytest tests/ -v\n# 34 tests covering scan, x402, MCP, discovery, OpenAPI\n```\n\n## Scripts\n\n| Script | What it does |\n|--------|-------------|\n| `scripts/precheck.sh` | Start-of-session check: branch, working tree, tests, live state, next backlog item |\n| `scripts/postcheck.sh` | End-of-session check: committer hygiene, tests, append to `docs/PROGRESS.md` |\n| `scripts/status.sh` | 30-second live-state check against scan.compuute.se (4 probes) |\n| `scripts/sbom.sh` | Generate CycloneDX SBOM, optionally upload to a GitHub Release |\n| `scripts/prospect-research.sh` | Pull qualified prospects from GitHub + Anthropic Registry, draft DM angles |\n| `scripts/measure-tiers.sh` | T0/T1/T2 distribution snapshot per [docs/agent-economy-strategy.md](docs/agent-economy-strategy.md) §5 — reach, engagement, conversion measured against Railway logs + Base RPC + GitHub stars |\n\n## Architecture\n\n- `api/services/scan.py` — clone + sandbox + scan + parse. Pure functions.\n- `api/services/x402_service.py` — x402 v2 verify / settle on the official `x402` SDK; CDP facilitator (Base mainnet) by default; Bazaar discovery extension in 402 bodies.\n- `api/services/cdp_auth.py` — minimal CDP API-key JWT auth for the facilitator (PyJWT + cryptography; avoids the full cdp-sdk).\n- `api/serializers/scan_serializer.py` — Pydantic models, strict validation.\n- `api/routes/scan.py` — HTTP layer for `/v1/scan`: idempotency, cache, ETag.\n- `api/routes/scan_x402.py` — HTTP layer for `/v1/scan/pay`.\n- `api/routes/discovery.py` — `/.well-known/*`, `/robots.txt`, `/sitemap.xml`.\n- `api/mcp_server.py` — FastMCP server exposing `scan_mcp_server`.\n- `main.py` — FastAPI wiring + middleware (security headers, CORS).\n\nBundled compuute-scan version is pinned in the Dockerfile (`ARG COMPUUTE_SCAN_REF=v0.6.2`).\n\n## Documentation\n\n| Doc | For |\n|-----|-----|\n| [docs/agent-economy-strategy.md](docs/agent-economy-strategy.md) | The strategic doc — a16z-verified data, the 11-signal buyer-agent model, two-track strategy, 30-day pivot trigger. Read first if you're trying to understand the company. |\n| [docs/STRATEGY.md](docs/STRATEGY.md) | Position, pricing tiers, roadmap, decision log |\n| [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) | Component diagram, request flow, threat model, deployment topology |\n| [docs/DEVELOPMENT.md](docs/DEVELOPMENT.md) | Local setup, layout, code style, common pitfalls — onboard a new dev in 30 min |\n| [docs/MONITORING.md](docs/MONITORING.md) | Endpoints to watch, automated checks, runbook for failures |\n| [docs/FP-RATES.md](docs/FP-RATES.md) | Per-rule false-positive transparency |\n| [docs/scan-self-triage.md](docs/scan-self-triage.md) | What this scanner reports when run against its own code |\n| [docs/whitepaper/](docs/whitepaper/) | MCP Security Methodology v1.0 (Markdown + PDF) |\n| [docs/case-studies/](docs/case-studies/) | Three anonymized engagement reports from the May 2026 batch |\n| [docs/advisories/](docs/advisories/) | Public advisories under the `COMPUUTE-YYYY-NNN` numbering |\n| [docs/security/](docs/security/) | Self-pentest reports (90-day cadence) |\n| [docs/audits/](docs/audits/) | The AI Procurement Risk Audit checklist (lead magnet) |\n| [docs/compliance/](docs/compliance/) | SOC 2 Type I readiness statement, TSC control mapping |\n| [docs/submissions/](docs/submissions/) | LangChain + CrewAI tool wrappers ready for PR/marketplace |\n| [skills/compuute-scan/](skills/compuute-scan/) | Claude Skill package (SKILL.md + scan.sh) — submitted to [anthropics/skills#1346](https://github.com/anthropics/skills/pull/1346) |\n| [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md) | Contributor Covenant 2.1 |\n| [docs/launches/](docs/launches/) | Show HN draft + posting checklist |\n| [docs/setup/](docs/setup/) | Status page (BetterStack) + analytics (PostHog) setup guides |\n| [docs/agentic-market-submission.md](docs/agentic-market-submission.md) | Three paths to Coinbase Agent.market listing |\n| [BACKLOG.md](BACKLOG.md) | GitHub Issues + Project board roadmap |\n| [IDEAS.md](IDEAS.md) | Composted product hypotheses with gating rules |\n| [CONTRIBUTING.md](CONTRIBUTING.md) | How to contribute |\n| [SECURITY.md](SECURITY.md) | Vulnerability disclosure policy (90-day window) |\n\n## Security\n\nFound a vulnerability? See [SECURITY.md](SECURITY.md) — email `security@compuute.se`. We follow a 90-day coordinated disclosure window.\n\n## License\n\nMIT (matches compuute-scan).\n\n## Author\n\nCompuute AB — `daniel@compuute.se`\n",
  "bytes": 11439,
  "sha": "10b23fbe954049356cbd02cd465dc1fae9ac3831d7040e979af7024c4ee076ba",
  "repo_slug": "compuute/compuute-scan-api",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_compuute_compuute_scan_api_02368d76/readme"
}