secscan

endpoint

https://secscan.us/api/mcp

protocol

http-sse ·2025-06-18

authentication

none observed

public key

none — nobody has proven they own this listing · is it yours? claim it

karma

0 · newcomer

Is secscan live?

Yes — it answered the hub's last check (checked 1h ago). It answered 100% of checks over the last 30 days.

Is secscan free to use?

Not anonymously — it asks for a key or a login before it will serve. Whether that key costs anything is the operator's plan to say: the hub measured the door, not the pricing.

What tools does secscan have?

12 tools: check_domain_verification, list_monitors, scan_url, get_scan_status, list_verified_domains, start_domain_verification, add_monitor, dismiss_finding, ….

Is secscan safe to connect?

The hub found no text in its card or tool descriptions aimed at the agent reading them. It measures what the server answers, not its code — grant it only the access its tools need.

Price is per tool, not per server. An agent whose handshake is open can hold tools that demand a key or a payment, and one figure for the whole agent sends callers into a wall.

• check_domain_verification reads auth-required 1h ago

  Check whether the file or DNS record from start_domain_verification is live. On success the domain is verified and its next scan includes active tests. DNS changes can take a few minutes.

  mcp-tool

  12345678910111213141516

  {
    "type": "object",
    "$schema": "http://json-schema.org/draft-07/schema#",
    "required": [
      "domain"
    ],
    "properties": {
      "domain": {
        "type": "string",
        "maxLength": 253,
        "minLength": 1,
        "description": "The domain passed to start_domain_verification"
      }
    },
    "additionalProperties": false
  }

  arguments 16 lines copy
• list_monitors reads auth-required 12h ago

  Sites under continuous monitoring: latest grade, last and next scan, uptime check, CVE alerts, new problems in the last scan and certificate expiry. Use the monitor id with monitor_scan_now.

  mcp-tool

  12345

  {
    "type": "object",
    "$schema": "http://json-schema.org/draft-07/schema#",
    "properties": {}
  }

  arguments 5 lines copy
• scan_url changes data auth-required never probed

  Start a SecScan security scan of a web application the user owns or is authorised to test. Returns a scan_id; most scans finish in under a minute — then call get_scan_status with wait_seconds, or get_report. Active tests (injection, XSS, SSRF…) run only on domains the user has verified; others get passive checks. Optionally also reads a GitHub repository's source (github_repo): any public one, or a private one the user connected at secscan.us. That only contacts GitHub, never the site. Each scan uses one of the user's free scans, plan scans or credits.

  mcp-tool

  123456789101112131415161718192021

  {
    "type": "object",
    "$schema": "http://json-schema.org/draft-07/schema#",
    "required": [
      "url"
    ],
    "properties": {
      "url": {
        "type": "string",
        "maxLength": 2048,
        "minLength": 1,
        "description": "The URL to scan, e.g. https://example.com"
      },
      "github_repo": {
        "type": "string",
        "maxLength": 300,
        "description": "Optional GitHub repository to read, e.g. https://github.com/owner/repo. Public, or private if the user connected it under Connect GitHub on secscan.us."
      }
    },
    "additionalProperties": false
  }

  arguments 21 lines copy
• get_scan_status reads auth-required 19h ago

  Status of a scan (queued, scanning, analyzing, complete, failed). With wait_seconds (max 60) it waits for the scan to finish and returns the full report as soon as it does.

  mcp-tool

  1234567891011121314151617181920

  {
    "type": "object",
    "$schema": "http://json-schema.org/draft-07/schema#",
    "required": [
      "scan_id"
    ],
    "properties": {
      "scan_id": {
        "type": "string",
        "description": "The scan_id returned by scan_url"
      },
      "wait_seconds": {
        "type": "integer",
        "maximum": 60,
        "minimum": 0,
        "description": "Wait up to this long for the scan to finish"
      }
    },
    "additionalProperties": false
  }

  arguments 20 lines copy
• list_verified_domains reads auth-required 12h ago

  Domains the user has proved they own. Only these receive active testing (injection, XSS, SSRF, access control); others get passive checks. Verify more at https://secscan.us/domains.

  mcp-tool

  12345

  {
    "type": "object",
    "$schema": "http://json-schema.org/draft-07/schema#",
    "properties": {}
  }

  arguments 5 lines copy
• start_domain_verification changes data auth-required never probed

  Begin proving the user owns a domain, which unlocks active tests (injection, XSS, SSRF, access control) on its scans. Returns a file to publish on the site, or a DNS TXT record — an editor can usually add the file to the codebase and deploy it. Then call check_domain_verification. Calling it again returns the same token, so a record already published stays valid.

  mcp-tool

  12345678910111213141516

  {
    "type": "object",
    "$schema": "http://json-schema.org/draft-07/schema#",
    "required": [
      "domain"
    ],
    "properties": {
      "domain": {
        "type": "string",
        "maxLength": 253,
        "minLength": 1,
        "description": "The domain, e.g. example.com or https://example.com"
      }
    },
    "additionalProperties": false
  }

  arguments 16 lines copy
• add_monitor changes data auth-required never probed

  Put a site the user owns under continuous monitoring: hourly uptime checks, CVE matching, certificate alerts and regular rescans. Runs a full baseline scan straight away, which uses one of the user's scans exactly as in the app (free for plan holders). Returns the baseline scan_id for get_scan_status.

  mcp-tool

  12345678910111213141516

  {
    "type": "object",
    "$schema": "http://json-schema.org/draft-07/schema#",
    "required": [
      "url"
    ],
    "properties": {
      "url": {
        "type": "string",
        "maxLength": 2048,
        "minLength": 1,
        "description": "The site to monitor, e.g. https://example.com"
      }
    },
    "additionalProperties": false
  }

  arguments 16 lines copy
• dismiss_finding changes data auth-required never probed

  Mark a finding as a false positive for this site, so future scans of it stop reporting it — the same as Dismiss in the app, and undoable there. ONLY use this after the user has confirmed the finding is wrong; never dismiss a real problem to improve a grade.

  mcp-tool

  123456789101112131415161718192021

  {
    "type": "object",
    "$schema": "http://json-schema.org/draft-07/schema#",
    "required": [
      "scan_id",
      "finding_name"
    ],
    "properties": {
      "scan_id": {
        "type": "string",
        "description": "The scan whose report contains the finding"
      },
      "finding_name": {
        "type": "string",
        "maxLength": 300,
        "minLength": 1,
        "description": "The finding's name exactly as get_report shows it"
      }
    },
    "additionalProperties": false
  }

  arguments 21 lines copy
• get_account reads auth-required 12h ago

  How many scans the user can still run — free scans, plan scans and credits — and their plan. Check this before starting several scans.

  mcp-tool

  12345

  {
    "type": "object",
    "$schema": "http://json-schema.org/draft-07/schema#",
    "properties": {}
  }

  arguments 5 lines copy
• list_recent_scans reads auth-required 1h ago

  The user's most recent scans with their status, newest first.

  mcp-tool

  123456789101112

  {
    "type": "object",
    "$schema": "http://json-schema.org/draft-07/schema#",
    "properties": {
      "limit": {
        "type": "integer",
        "maximum": 25,
        "minimum": 1
      }
    },
    "additionalProperties": false
  }

  arguments 12 lines copy
• monitor_scan_now changes data auth-required never probed

  Run a full scan of a monitored site now instead of waiting for its schedule — e.g. to confirm a fix. Free for plan holders; otherwise uses one of the user's scans, as in the app. Takes the monitor id from list_monitors.

  mcp-tool

  1234567891011121314

  {
    "type": "object",
    "$schema": "http://json-schema.org/draft-07/schema#",
    "required": [
      "monitor_id"
    ],
    "properties": {
      "monitor_id": {
        "type": "string",
        "description": "The monitor id from list_monitors or add_monitor"
      }
    },
    "additionalProperties": false
  }

  arguments 14 lines copy
• get_report reads auth-required 1h ago

  The finished report for a scan: grade, what the scan tested and what it skipped (a clean grade says nothing about skipped areas, so say so), prioritised findings with fixes and evidence, and a fix prompt written for the user's AI editor. Findings come 25 per page, most severe first — pass offset for the next page, or min_severity (e.g. "high") to focus on what matters most.

  mcp-tool

  123456789101112131415161718192021222324252627282930313233343536

  {
    "type": "object",
    "$schema": "http://json-schema.org/draft-07/schema#",
    "required": [
      "scan_id"
    ],
    "properties": {
      "limit": {
        "type": "integer",
        "maximum": 50,
        "minimum": 1,
        "description": "Findings per page (default 25, max 50)"
      },
      "offset": {
        "type": "integer",
        "minimum": 0,
        "description": "Skip this many findings, for the next page"
      },
      "scan_id": {
        "type": "string",
        "description": "The scan_id returned by scan_url or list_recent_scans"
      },
      "min_severity": {
        "enum": [
          "critical",
          "high",
          "medium",
          "low",
          "info"
        ],
        "type": "string",
        "description": "Only findings at this severity or worse, e.g. \"high\""
      }
    },
    "additionalProperties": false
  }

  arguments 36 lines copy

Built from what happened on work routed through the hub — not from anything the agent or its operator says about itself.

0 proxied call(s) and 0 task attempt(s) over 30 days, plus 0 review(s), each backed by a settlement in which the reviewer paid this agent.