io.github.securityscan-api/securityscan
Security for AI agents: MCP audits, secret redaction, skill vetting, network scans, agent checkout.
Open source Open in the app JSON README (API)
About
Security for AI agents: MCP audits, secret redaction, skill vetting, network scans, agent checkout.
Details
- Kind
- MCP servers
- Topic
- E-commerce & business
- Publisher
- securityscan-api
- Origin
- official
- Category
- ferramentas
- Transport
- local
- Version
- 0.2.0
- Last push
- 2026-08-30T15:56:53Z
- Repository state
- ativo
- Language
- Python
- License
- Apache-2.0
- Added
- 2026-08-30 18:01:02
- Updated
- 2026-08-30 18:01:02
- Origin id
io.github.securityscan-api/securityscan
README
# SecurityScan MCP
<!-- mcp-name: io.github.securityscan-api/securityscan -->
> Give your AI agent the ability to secure its own environment — one MCP config, eight tools.
>
> Audit MCP configs for poisoning, redact secrets/PII before they leave for an LLM, vet untrusted
> skills, monitor dependency health, and actively scan your network. All from a single `securitystack`
> entry in your agent's MCP config.
This is the **client**: the unified MCP server an AI agent (Claude CLI/Desktop, or any MCP-aware
agent) installs to call the SecurityScan hosted services. The backend services themselves are hosted
— you don't run them. You configure API keys and your agent gets eight tools — six security plus two sales.
## Why
An AI agent has four ways to get compromised. SecurityScan covers all four:
```
1. What it INSTALLS → poisoned skills / MCP configs → scan_skill + audit_mcp_server_config
2. What it DEPENDS ON → a dependency goes down/rogue → check_dependencies
3. Where it's EXPOSED → open ports, default creds → network_scan (with AI agent loop)
4. What it SENDS OUT → secrets/PII leak into the LLM → scan_secrets
```
Two of these — `audit_mcp_server_config` and `scan_secrets` — run **offline, in-process, with no API
key**. They work the moment you install the server. The other four call hosted services (configure
their keys to enable them; each is skipped gracefully if unset).
## Install
### 1. Install the server
```bash
pip install securityscan-mcp
```
That's it — the package is on PyPI.
### 2. Add it to your agent
For **Claude Desktop / CLI** (`claude_desktop_config.json` or `~/.claude.json`):
```json
{
"mcpServers": {
"securityscan": {
"command": "python",
"args": ["-m", "stack.unified_mcp_server"],
"env": {
"ACTIVESCANNER_API_KEY": "ask_live_...",
"DEPSCAN_API_KEY": "dsk_live_...",
"SECURITYSCAN_API_KEY": "ss_live_...",
"SECRETSCAN_API_KEY": "ssc_..."
}
}
}
}
```
The three offline tools (`audit_mcp_server_config`, `scan_secrets`, `securitystack_pricing`) need **no key** and work immediately.
The four hosted-service tools activate when you set their key; set only what you use.
> Get a free API key (no credit card):
> ```bash
> curl -X POST https://scan.apisecurityscan.net/v1/register -d '{}'
> ```
> See [docs/QUICKSTART.md](docs/QUICKSTART.md) for the 2-minute setup.
### 3. Verify
```bash
claude mcp list
# securitystack ... Connected
```
Then ask your agent: *"Audit my MCP config for security risks"* or *"Scan this prompt for secrets
before I send it: ..."*
## The eight tools
| Tool | What it does | Needs a key? |
|------|--------------|--------------|
| `audit_mcp_server_config` | Audits an MCP config for tool poisoning, leaked credentials, supply-chain risk, toxic capability pairs (OWASP MCP Top 10). | **No** — runs offline |
| `scan_secrets` | Detects & redacts secrets (API keys, tokens, private keys) + PII (email, phone, SSN, credit card, IBAN) in a payload before it leaves for an LLM/API. **Runs offline in-process with no key; routes to the backend if a key is set.** | **No** — runs offline |
| `scan_skill` | Analyzes an untrusted AI skill for prompt injection, malware patterns, OWASP LLM Top 10 — before you install it. | `SECURITYSCAN_API_KEY` |
| `check_dependencies` | Checks the health (uptime, SSL, blacklist, trust score) of endpoints your agent depends on. | `DEPSCAN_API_KEY` |
| `network_scan` | Active security scan of a device/host with an autonomous AI agent that reasons about findings. **Requires `authorized: true`** — only scan what you own. | `ACTIVESCANNER_API_KEY` |
| `full_stack_audit` | All of the above correlated into one prioritized report. | per-tool keys |
| `securitystack_pricing` | Tier/price/quota catalog with the benchmark evidence behind it — evaluate or recommend a purchase to your user. | **No** — runs offline |
| `securitystack_checkout` | Agent-native purchase: opens a Stripe checkout for a tier and returns the payment URL plus a PENDING API key that activates automatically on payment. | **No** — public endpoint |
## Authorization & legality
`network_scan` performs active scanning. You **must** set `authorized: true` to certify you own or
have permission to scan the target. Scanning without authorization may violate the CFAA (US), the
Computer Misuse Act (UK), and similar laws. See the [Terms of Service](docs/TERMS.md).
## License
Apache-2.0. See [LICENSE](LICENSE).