SecurityScan
Scan GitHub-hosted AI skills for vulnerabilities: prompt injection, malware, OWASP LLM Top 10.
사용해야 할까요
품질 및 안전성
도구 정의와 프로토콜 준수에 대한 자동 분석을 기반으로 합니다.
컨텍스트 비용
이는 서버의 도구가 모델의 컨텍스트에 로드될 때마다 소비되는 대략적인 토큰 수입니다. 수치가 높을수록 다른 작업에 사용할 수 있는 주의가 줄어듭니다.
설치
원클릭 설치
`claude_desktop_config.json` 파일에 다음을 추가하세요:
{
"mcpServers": {
"securityscan": {
"url": "https://apisecurityscan.net/mcp"
}
}
}원격 엔드포인트
https://apisecurityscan.net/mcpstreamable-http할 수 있는 일
도구 목록
도구 (8)
🟢scan_skill(skill_url)
Analyze an AI agent skill for prompt injection, malware patterns, and OWASP LLM Top 10 issues BEFORE installing it (SecurityScan).
입력 스키마
{
"type": "object",
"properties": {
"skill_url": {
"type": "string",
"description": "URL of the skill to analyze (e.g. a GitHub skill URL)."
}
},
"required": [
"skill_url"
],
"additionalProperties": false
}출력 스키마
{
"type": "object",
"properties": {
"result": {
"type": "string"
}
},
"required": [
"result"
],
"x-fastmcp-wrap-result": true
}🟢check_dependencies(endpoints)
Check the health of your agent's external dependencies: uptime, SSL validity, blacklist status, and a trust score 0-100 (DepScan).
입력 스키마
{
"type": "object",
"properties": {
"endpoints": {
"items": {
"type": "string"
},
"type": "array",
"description": "List of URLs your agent/skill depends on,\n e.g. [\"https://api.openai.com\", \"https://api.stripe.com\"]"
}
},
"required": [
"endpoints"
],
"additionalProperties": false
}출력 스키마
{
"type": "object",
"properties": {
"result": {
"type": "string"
}
},
"required": [
"result"
],
"x-fastmcp-wrap-result": true
}⚪network_scan(target, authorized, scan_type)
Active security scan of a device or host with an autonomous AI agent that decides which follow-up probes to run (ActiveScanner). Only scan targets you own or have permission to test.
입력 스키마
{
"type": "object",
"properties": {
"target": {
"type": "string",
"description": "IP, CIDR, or hostname. Examples: \"192.168.1.1\", \"10.0.0.0/24\""
},
"authorized": {
"type": "boolean",
"description": "REQUIRED. You must set this to True to certify that you own\n the target or have explicit permission to test it. Setting it\n to False (or omitting it) aborts the scan. Scanning without\n authorization may be illegal (CFAA / Computer Misuse Act)."
},
"scan_type": {
"default": "quick",
"type": "string",
"description": "\"quick\" (~30s, top ports) [default], \"standard\" (~2min,\n agent loop), \"deep\" (~10min, full ports + credentials check)"
}
},
"required": [
"target",
"authorized"
],
"additionalProperties": false
}출력 스키마
{
"type": "object",
"properties": {
"result": {
"type": "string"
}
},
"required": [
"result"
],
"x-fastmcp-wrap-result": true
}🟢audit_mcp_server_config(config_json)
Audit an MCP client configuration for security risks — works offline, no external service required. Detects: tool poisoning, hidden/coercive instructions in tool descriptions, hardcoded credentials, unpinned packages (rug-pull risk), insecure transport, and toxic capability combinations (shell + network, file-read + network).
입력 스키마
{
"type": "object",
"properties": {
"config_json": {
"type": "string",
"description": "The FULL JSON content of the MCP config file as a string\n (e.g. claude_desktop_config.json or .mcp.json). Paste the\n file content, not the path."
}
},
"required": [
"config_json"
],
"additionalProperties": false
}출력 스키마
{
"type": "object",
"properties": {
"result": {
"type": "string"
}
},
"required": [
"result"
],
"x-fastmcp-wrap-result": true
}⚪scan_secrets(text, redact)
Scan a text payload (a prompt, an outbound API body, a file's contents) for secrets and PII BEFORE it leaves for an LLM or external API, and return a redacted copy. Catches the #1 real-world agent incident: secrets/PII leaking into a model's context. WORKS OFFLINE with no API key — the detection runs in-process (pure regex + Luhn check, no network). If a SecretScan backend key IS configured, the scan is routed there instead (which also persists an audit record).
입력 스키마
{
"type": "object",
"properties": {
"text": {
"type": "string",
"description": "The payload to inspect (prompt, request body, document text)."
},
"redact": {
"default": true,
"type": "boolean",
"description": "If True (default), each match is replaced with a token like\n [REDACTED-KEY] / [REDACTED-EMAIL]. If False, only reports."
}
},
"required": [
"text"
],
"additionalProperties": false
}출력 스키마
{
"type": "object",
"properties": {
"result": {
"type": "string"
}
},
"required": [
"result"
],
"x-fastmcp-wrap-result": true
}🟡full_stack_audit(mcp_config_json, dependency_endpoints, skill_url, network_target, network_authorized, ...)
Complete security posture in one call: audits the MCP config, checks dependency health, analyzes an untrusted skill, scans the local network gateway, and scans any payload you're about to send out for secrets/PII — then correlates everything into a single prioritized report. Pass only what you have; each section is skipped gracefully if its input or service is missing.
입력 스키마
{
"type": "object",
"properties": {
"mcp_config_json": {
"default": "",
"type": "string",
"description": "MCP config content as string (optional)"
},
"dependency_endpoints": {
"anyOf": [
{
"items": {
"type": "string"
},
"type": "array"
},
{
"type": "null"
}
],
"default": null,
"description": "URLs your stack depends on (optional)"
},
"skill_url": {
"default": "",
"type": "string",
"description": "untrusted skill to vet (optional)"
},
"network_target": {
"default": "",
"type": "string",
"description": "IP to scan, e.g. \"192.168.1.1\" (optional)"
},
"network_authorized": {
"default": false,
"type": "boolean",
"description": "REQUIRED to scan network_target. Set True to certify\n you own or have permission to scan it. (optional, default False)"
},
"text_to_scan": {
"default": "",
"type": "string",
"description": "payload to vet for secret/PII egress (optional)"
}
},
"additionalProperties": false
}출력 스키마
{
"type": "object",
"properties": {
"result": {
"type": "string"
}
},
"required": [
"result"
],
"x-fastmcp-wrap-result": true
}⚪securityscan_pricing
SecurityScan catalog: tiers, prices, quotas and the evidence behind the product — the fact sheet an agent needs to evaluate or recommend a purchase to its user. Fully offline, no API key required. Returns: JSON with the tier table (price / target slots / scan types), the pricing model, benchmark evidence, and how to buy.
입력 스키마
{
"type": "object",
"properties": {},
"additionalProperties": false
}출력 스키마
{
"type": "object",
"properties": {
"result": {
"type": "string"
}
},
"required": [
"result"
],
"x-fastmcp-wrap-result": true
}⚪securityscan_checkout(tier, email, existing_key)
Start a Stripe checkout to buy a SecurityScan tier (agent-native sales). Returns a payment URL to hand to your user AND a PENDING API key that activates automatically once payment clears — no other setup step.
입력 스키마
{
"type": "object",
"properties": {
"tier": {
"type": "string",
"description": "one of \"founder\" ($29 one-time), \"personal\", \"executive\",\n \"enterprise\" (monthly)"
},
"email": {
"default": "",
"type": "string",
"description": "optional — prefills the Stripe checkout page for your user"
},
"existing_key": {
"default": "",
"type": "string",
"description": "optional — upgrade an existing ask_live_ key instead of\n minting a new one"
}
},
"required": [
"tier"
],
"additionalProperties": false
}출력 스키마
{
"type": "object",
"properties": {
"result": {
"type": "string"
}
},
"required": [
"result"
],
"x-fastmcp-wrap-result": true
}커뮤니티
증거