{
  "markdown": "# Cyber Lens AI MCP Server\n\n> **Security scanning for AI assistants and agentic coding workflows.**\n\n[![MCP](https://img.shields.io/badge/MCP-Compatible-purple)](https://modelcontextprotocol.io)\n[![Open CLAW](https://img.shields.io/badge/Open%20CLAW-Native%20Support-blue)](https://openclaw.ai)\n[![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](LICENSE)\n[![Node.js](https://img.shields.io/badge/Node.js-18%2B-339933)](https://nodejs.org)\n\nA [Model Context Protocol](https://modelcontextprotocol.io) (MCP) server that gives AI assistants the ability to scan websites, public repositories, and [Open CLAW](https://openclaw.ai) skills for security vulnerabilities. It's purpose-built for the agentic coding era, with native support for scanning skill packages before you install them.\n\n---\n\n## What It Does\n\nWhen connected to an AI assistant (Claude Desktop, VS Code, etc.), this MCP server adds security scanning tools that the assistant can use during your conversation:\n\n- **Scan a CLAW skill** before installing it -- the server downloads the skill package, extracts it, and analyses the actual source code for dangerous patterns, hardcoded secrets, and permission issues\n- **Scan a website** in a local quick mode without an account, or use the full cloud scan when connected\n- **Scan a public repository** for exposed secrets, dependency vulnerabilities, suspicious code patterns, and trust posture issues\n- **Check your remaining cloud scan quota** before kicking off a batch of scans\n- **Get remediation guidance** with step-by-step fix instructions and code examples\n\n### Example Conversation\n\n```\nYou:    \"I want to install this skill: https://clawhub.ai/skills/ontology\"\n\nClaude: I'll scan it for security issues first.\n\n        [PASS] CLAW Skill Security Scan: ontology v1.0.4\n\n        Security Score: 95/100\n        Files Analyzed: 5\n\n        Skill appears safe to install. Minor issues noted below.\n\n        1. [MEDIUM] File write operation\n           File: scripts/ontology.py:399\n           Fix: Ensure file writes are limited to expected directories.\n\n        The skill looks safe. It writes to the filesystem for its knowledge\n        graph storage, which is expected behaviour for this type of skill.\n```\n\n---\n\n## Getting Started\n\n### 1. Install\n\nAfter the first npm release, the recommended install path is:\n\n```bash\nnpx -y @shadoprizm/cyberlens-mcp-server\n```\n\nBefore that, or for local development and manual builds:\n\n```bash\ngit clone https://github.com/shadoprizm/cyberlens-mcp-server.git\ncd cyberlens-mcp-server\nnpm install\nnpm run build\n```\n\n### 2. Add to Your AI Assistant\n\n**Claude Desktop** -- add to `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS) or `%APPDATA%\\Claude\\claude_desktop_config.json` (Windows):\n\n```json\n{\n  \"mcpServers\": {\n    \"cyberlens\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@shadoprizm/cyberlens-mcp-server\"]\n    }\n  }\n}\n```\n\nIf you are running from a source checkout instead of npm:\n\n```json\n{\n  \"mcpServers\": {\n    \"cyberlens\": {\n      \"command\": \"node\",\n      \"args\": [\"/absolute/path/to/cyberlens-mcp-server/dist/index.js\"]\n    }\n  }\n}\n```\n\n**Claude Code** -- add to your MCP settings or project configuration.\n\n**VS Code (Copilot/Continue)** -- configure per your extension's MCP server settings.\n\n### 3. Connect Your Account\n\nWebsite tools work immediately without an account in local quick mode. That local mode covers roughly 15 core checks and returns results right away.\n\nConnecting an account upgrades website scans to the full CyberLens cloud path with 70+ checks, scan history, and AI analysis. Repository and account-only tools still connect through the browser flow when needed.\n\nWhen a repository or account-only tool needs an account, the MCP server:\n\n1. opens the CyberLens browser flow automatically\n2. sends the user to `cyberlensai.com` to sign up or log in\n3. receives the secure callback locally\n4. saves the API key to `~/.cyberlens/mcp/config.json`\n5. continues the original tool call automatically\n\nYou can also trigger the same flow explicitly:\n\n```\nYou: \"Connect my CyberLens account\"\n```\n\nThis opens your browser to [cyberlensai.com](https://cyberlensai.com) where you can sign up (free) or log in. Your API key is saved locally at `~/.cyberlens/mcp/config.json` and used for all future scans.\n\n**Free accounts** include 5 scans/month. No credit card required.\n\n> You can also set the `CYBERLENS_API_KEY` environment variable in the MCP config instead of using the browser flow.\n\nIf a cloud website scan hits its monthly quota, the MCP server opens the CyberLens pricing page automatically and falls back to the local quick scan instead of hard-failing. Repository scans still require cloud quota.\n\n---\n\n## Available Tools\n\n### Account\n\n| Tool | Description | Requires API Key |\n|------|-------------|:---:|\n| `connect_account` | Opens browser to sign up/log in and saves your API key locally | No |\n| `get_account_quota` | Shows your current plan and remaining website/repository scan quota; auto-connects on first use if needed | Yes |\n\n### CLAW Skill Scanning\n\n| Tool | Description | Requires API Key |\n|------|-------------|:---:|\n| `scan_claw_skill` | Download and analyse a CLAW Hub or direct skill package for security issues | No |\n| `validate_claw_skill` | Validate a skill manifest against security best practices | No |\n\n### Website & Repository Scanning\n\n| Tool | Description | Requires API Key |\n|------|-------------|:---:|\n| `scan_website` | Local quick website scan without an account; full cloud scan when connected; local fallback if website cloud quota is exhausted | No for local, Yes for full cloud |\n| `scan_repository` | Public repository security scan for GitHub, GitLab, Bitbucket, and supported ZIP targets; auto-connects on first use if needed | Yes |\n| `get_scan_results` | Retrieve detailed findings from a completed cloud scan; auto-connects on first use if needed | Yes |\n| `get_security_score` | Local quick website score without an account; full cloud score when connected | No for local, Yes for full cloud |\n\n### Intelligence & Guidance\n\n| Tool | Description | Requires API Key |\n|------|-------------|:---:|\n| `get_remediation_guide` | Built-in local remediation playbooks for common CWEs and vulnerability classes | No |\n| `get_scan_transparency` | Honest report of the MCP server's local checks and live cloud endpoints | No |\n\n---\n\n## How Skill Scanning Works\n\nWhen you provide a CLAW skill URL, the MCP server:\n\n1. **Resolves the URL** -- accepts Claw Hub pages (`https://clawhub.ai/skills/skill-name`), direct download links (`https://*.convex.site/api/v1/download?slug=name`), or any URL pointing to a skill zip\n2. **Downloads the skill package** to a temporary directory\n3. **Extracts and analyses** every file in the package:\n   - Checks `_meta.json` and `SKILL.md` for completeness\n   - Scans all source code (Python, JavaScript, TypeScript, shell scripts, config files) for dangerous patterns\n   - Detects hardcoded secrets, `eval()` usage, shell command execution, insecure HTTP requests, file deletion operations, pickle deserialisation, and more\n   - Identifies unpinned dependencies\n   - Catalogues all external URLs the skill communicates with\n4. **Returns a security score** (0-100) with detailed findings, file locations, and fix recommendations\n5. **Cleans up** all temporary files\n\nThis entire process runs locally -- no API key is required and your code is never sent to an external server.\n\n## Website Scan Modes\n\n`scan_website` and `get_security_score` now have two honest modes:\n\n- **Local Quick Scan** -- works without an account, returns immediately, and covers roughly 15 core website checks such as HTTPS, security headers, server disclosure, insecure forms, and inline-script indicators\n- **Full Cloud Scan** -- requires a connected CyberLens account, runs 70+ checks, keeps cloud scan history, and includes richer analysis\n\nIf a user asks for a `full` or `database` website scan without an account, the MCP server still returns the local quick scan and says that the requested cloud-only mode was not available.\n\nIf a connected user runs out of website cloud quota, CyberLens falls back to the local quick scan automatically and opens the pricing page with an upgrade link.\n\n### Accepted URL Formats\n\n```\nhttps://clawhub.ai/skills/ontology            --> Resolves automatically\nhttps://clawhub.ai/author/skill-name          --> Resolves automatically\nhttps://*.convex.site/api/v1/download?slug=x  --> Direct download\n```\n\n---\n\n## Architecture\n\n```\nsrc/\n  index.ts          MCP server, tool handlers, output formatting\n  auth.ts           Browser-based connect flow, config file management\n  client.ts         REST API client for live scan and quota endpoints\n  remediation-guides.ts  Local CWE and vulnerability remediation guidance\n  schemas.ts        Zod input validation schemas\n  skill-scanner.ts  Local CLAW skill analyser (download, extract, scan)\n  skill-validation.ts    Local CLAW manifest validation\n  transparency.ts        Local transparency report for scan coverage\n```\n\n**Key design decisions:**\n\n- **No Supabase SDK** -- pure REST calls with `fetch` and `X-API-Key` header\n- **Truthful cloud surface** -- the MCP server only exposes cloud-backed tools that are supported by the live public API (`/scan`, `/scan/{id}`, `/quota`)\n- **Stdio transport** -- runs as a subprocess of the AI assistant, communicates via stdin/stdout\n- **Useful without API key** -- skill scanning, website quick scans, manifest validation, remediation guidance, and transparency reporting work locally; connecting an account upgrades website scans to the full cloud path and unlocks repository scanning\n- **Browser-based auth** -- same secure connect flow as the CyberLens OpenClaw skill (CSRF-protected, short-lived exchange codes, HTTPS-only)\n\n---\n\n## Development\n\n```bash\n# Build\nnpm run build\n\n# Watch mode\nnpm run dev\n\n# Run directly (for testing)\necho '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{\"protocolVersion\":\"2024-11-05\",\"capabilities\":{},\"clientInfo\":{\"name\":\"test\",\"version\":\"1.0.0\"}}}' | node dist/index.js\n```\n\n### Environment Variables\n\n| Variable | Required | Default | Description |\n|----------|:---:|---------|-------------|\n| `CYBERLENS_API_KEY` | No | -- | API key (alternative to browser connect flow) |\n| `CYBERLENS_API_BASE_URL` | No | `https://api.cyberlensai.com/functions/v1/public-api-scan` | API endpoint override |\n\n---\n\n## Publishing\n\nThis repository is prepared for npm + MCP Registry publication as:\n\n- npm package: `@shadoprizm/cyberlens-mcp-server`\n- MCP server name: `io.github.shadoprizm/cyberlens-mcp-server`\n\nTypical release flow:\n\n```bash\n# 1. Bump the version\nnpm version patch\n\n# 2. Publish the package to npm\nnpm publish\n\n# 3. Authenticate with the MCP Registry\nmcp-publisher login github\n\n# 4. Publish server.json to the MCP Registry\nmcp-publisher publish\n```\n\nThe registry metadata lives in the root `server.json` file and the npm ownership check uses the `mcpName` field in `package.json`.\n\n---\n\n## Related Projects\n\n- **[CyberLens OpenClaw Skill](https://clawhub.ai/shadoprizm/cyberlens)** -- the OpenClaw skill version with the same scanning capabilities\n- **[CyberLens](https://cyberlensai.com)** -- the full platform with browser-based scanning, dashboards, and reporting\n- **[OpenClaw](https://openclaw.ai)** -- the open skill ecosystem for AI agents\n\n---\n\n## License\n\n[MIT](LICENSE)\n",
  "bytes": 11434,
  "sha": "fc8565aa14afcab4226ed65be7cad0e928e024aed4d87267c67deff5e396b3e2",
  "repo_slug": "shadoprizm/cyberlens-mcp-server",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_shadoprizm_cyberlens_mcp_serve_6c209aac/readme"
}