{
  "markdown": "# SecurityScan MCP\n\n<!-- mcp-name: io.github.securityscan-api/securityscan -->\n\n> Give your AI agent the ability to secure its own environment — one MCP config, eight tools.\n>\n> Audit MCP configs for poisoning, redact secrets/PII before they leave for an LLM, vet untrusted\n> skills, monitor dependency health, and actively scan your network. All from a single `securitystack`\n> entry in your agent's MCP config.\n\nThis is the **client**: the unified MCP server an AI agent (Claude CLI/Desktop, or any MCP-aware\nagent) installs to call the SecurityScan hosted services. The backend services themselves are hosted\n— you don't run them. You configure API keys and your agent gets eight tools — six security plus two sales.\n\n## Why\n\nAn AI agent has four ways to get compromised. SecurityScan covers all four:\n\n```\n1. What it INSTALLS   → poisoned skills / MCP configs     → scan_skill + audit_mcp_server_config\n2. What it DEPENDS ON → a dependency goes down/rogue        → check_dependencies\n3. Where it's EXPOSED → open ports, default creds           → network_scan (with AI agent loop)\n4. What it SENDS OUT  → secrets/PII leak into the LLM       → scan_secrets\n```\n\nTwo of these — `audit_mcp_server_config` and `scan_secrets` — run **offline, in-process, with no API\nkey**. They work the moment you install the server. The other four call hosted services (configure\ntheir keys to enable them; each is skipped gracefully if unset).\n\n## Install\n\n### 1. Install the server\n\n```bash\npip install securityscan-mcp\n```\n\nThat's it — the package is on PyPI.\n\n### 2. Add it to your agent\n\nFor **Claude Desktop / CLI** (`claude_desktop_config.json` or `~/.claude.json`):\n\n```json\n{\n  \"mcpServers\": {\n    \"securityscan\": {\n      \"command\": \"python\",\n      \"args\": [\"-m\", \"stack.unified_mcp_server\"],\n      \"env\": {\n        \"ACTIVESCANNER_API_KEY\": \"ask_live_...\",\n        \"DEPSCAN_API_KEY\": \"dsk_live_...\",\n        \"SECURITYSCAN_API_KEY\": \"ss_live_...\",\n        \"SECRETSCAN_API_KEY\": \"ssc_...\"\n      }\n    }\n  }\n}\n```\n\nThe three offline tools (`audit_mcp_server_config`, `scan_secrets`, `securitystack_pricing`) need **no key** and work immediately.\nThe four hosted-service tools activate when you set their key; set only what you use.\n\n> Get a free API key (no credit card):\n> ```bash\n> curl -X POST https://scan.apisecurityscan.net/v1/register -d '{}'\n> ```\n> See [docs/QUICKSTART.md](docs/QUICKSTART.md) for the 2-minute setup.\n\n### 3. Verify\n\n```bash\nclaude mcp list\n# securitystack ... Connected\n```\n\nThen ask your agent: *\"Audit my MCP config for security risks\"* or *\"Scan this prompt for secrets\nbefore I send it: ...\"*\n\n## The eight tools\n\n| Tool | What it does | Needs a key? |\n|------|--------------|--------------|\n| `audit_mcp_server_config` | Audits an MCP config for tool poisoning, leaked credentials, supply-chain risk, toxic capability pairs (OWASP MCP Top 10). | **No** — runs offline |\n| `scan_secrets` | Detects & redacts secrets (API keys, tokens, private keys) + PII (email, phone, SSN, credit card, IBAN) in a payload before it leaves for an LLM/API. **Runs offline in-process with no key; routes to the backend if a key is set.** | **No** — runs offline |\n| `scan_skill` | Analyzes an untrusted AI skill for prompt injection, malware patterns, OWASP LLM Top 10 — before you install it. | `SECURITYSCAN_API_KEY` |\n| `check_dependencies` | Checks the health (uptime, SSL, blacklist, trust score) of endpoints your agent depends on. | `DEPSCAN_API_KEY` |\n| `network_scan` | Active security scan of a device/host with an autonomous AI agent that reasons about findings. **Requires `authorized: true`** — only scan what you own. | `ACTIVESCANNER_API_KEY` |\n| `full_stack_audit` | All of the above correlated into one prioritized report. | per-tool keys |\n| `securitystack_pricing` | Tier/price/quota catalog with the benchmark evidence behind it — evaluate or recommend a purchase to your user. | **No** — runs offline |\n| `securitystack_checkout` | Agent-native purchase: opens a Stripe checkout for a tier and returns the payment URL plus a PENDING API key that activates automatically on payment. | **No** — public endpoint |\n\n## Authorization & legality\n\n`network_scan` performs active scanning. You **must** set `authorized: true` to certify you own or\nhave permission to scan the target. Scanning without authorization may violate the CFAA (US), the\nComputer Misuse Act (UK), and similar laws. See the [Terms of Service](docs/TERMS.md).\n\n## License\n\nApache-2.0. See [LICENSE](LICENSE).\n",
  "bytes": 4498,
  "sha": "fdd2e35fd035cc790ad6bd2909104ee7d6382e02fd7ca5c6805a177d1f4b5250",
  "repo_slug": "securityscan-api/securitystack-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_securityscan_api_securityscan_99fbe1de/readme"
}