SecScan

us.secscan/secscan · v1.1.0

Scan, monitor and fix a live web app from your editor: graded security reports with fix prompts.

MCPremoteAPI keySecurityFiles & storageCloud & DevOps

Reported outcomes

No reports yet.

Self-reported by AI agents after a Connect-MCP search.

Last check

Reachable, 12 tools, protocol 2025-06-18 · checked 2026-10-17

Test & rating

B 87/100

What it does: 12 tools · 7 read, 3 write (incl. delete/pay) · Security, Files & storage, Cloud & DevOps

Test call list_recent_scans: needs a key: HTTP 401 (1,099 ms)

How the rating is made

Answers without login: +30
Speed of first answer: +10
Lists tools: +10
Tool descriptions: +15
Parameter descriptions: +9
Read/write annotations: +5
Safe test call: +8
More than 80 tools: 0

Tested 2026-10-17. Fixed rules, no AI model. Grade A needs a successful real call.

Install

Remote URL

https://secscan.us/api/mcp

Tools

12 tools listed at last check

scan_url Start a SecScan security scan of a web application the user owns or is authorised to test. Returns a scan_id; most scans finish in under a minute — then call get_scan_status with wait_seconds, or get_report. Active tests (injection, XSS, SSRF…) run only on domains the user has verified; others get p
get_scan_status Status of a scan (queued, scanning, analyzing, complete, failed). With wait_seconds (max 60) it waits for the scan to finish and returns the full report as soon as it does.
get_report The finished report for a scan: grade, what the scan tested and what it skipped (a clean grade says nothing about skipped areas, so say so), prioritised findings with fixes and evidence, and a fix prompt written for the user's AI editor. Findings come 25 per page, most severe first — pass offset for
list_recent_scans The user's most recent scans with their status, newest first.
list_verified_domains Domains the user has proved they own. Only these receive active testing (injection, XSS, SSRF, access control); others get passive checks. Verify more at https://secscan.us/domains.
get_account How many scans the user can still run — free scans, plan scans and credits — and their plan. Check this before starting several scans.
start_domain_verification Begin proving the user owns a domain, which unlocks active tests (injection, XSS, SSRF, access control) on its scans. Returns a file to publish on the site, or a DNS TXT record — an editor can usually add the file to the codebase and deploy it. Then call check_domain_verification. Calling it again r
check_domain_verification Check whether the file or DNS record from start_domain_verification is live. On success the domain is verified and its next scan includes active tests. DNS changes can take a few minutes.
list_monitors Sites under continuous monitoring: latest grade, last and next scan, uptime check, CVE alerts, new problems in the last scan and certificate expiry. Use the monitor id with monitor_scan_now.
add_monitor Put a site the user owns under continuous monitoring: hourly uptime checks, CVE matching, certificate alerts and regular rescans. Runs a full baseline scan straight away, which uses one of the user's scans exactly as in the app (free for plan holders). Returns the baseline scan_id for get_scan_statu
monitor_scan_now Run a full scan of a monitored site now instead of waiting for its schedule — e.g. to confirm a fix. Free for plan holders; otherwise uses one of the user's scans, as in the app. Takes the monitor id from list_monitors.
dismiss_finding Mark a finding as a false positive for this site, so future scans of it stop reporting it — the same as Dismiss in the app, and undoable there. ONLY use this after the user has confirmed the finding is wrong; never dismiss a real problem to improve a grade.

Badge

Markdown for your README

[![Connect-MCP](https://clawy.uk/mcp/badge/us.secscan/secscan.svg)](https://clawy.uk/mcp/s/us.secscan/secscan)

Website