SimplyScan
Security, SEO and AI-visibility scanner for web apps · free scans and focused checks via MCP.
Should I use this
Quality & Safety
Findings (2)
- LOWTool 'check_security_headers' description lacks action verbin check_security_headers
- LOWTool 'check_exposed_files' description lacks action verbin check_exposed_files
Based on automated analysis of tool definitions and protocol compliance.
Context Cost
This is the approximate number of tokens consumed each time the server's tools are loaded into a model's context. Higher counts reduce the attention available for other tasks.
Install
One-Click Install
Add this to your `claude_desktop_config.json` file:
{
"mcpServers": {
"simplyscan": {
"url": "https://api.simplyscan.io/mcp"
}
}
}Remote endpoints
https://api.simplyscan.io/mcpstreamable-httpWhat it can do
Tool inventory
Tools (8)
⚪scan_website(url)
Run a SimplyScan Security Engine security & speed scan (Pro with an entitled API key; otherwise free) of a deployed web app URL. Returns a 0-100 score and findings (exposed secrets, missing Supabase RLS, frontend leaks, speed issues). Best for apps built with Lovable, Bolt, v0, Cursor, Replit, etc.
Input Schema
{
"type": "object",
"properties": {
"url": {
"type": "string",
"format": "uri",
"description": "Full https URL to check"
}
},
"required": [
"url"
],
"$schema": "https://json-schema.org/draft/2020-12/schema",
"additionalProperties": false
}🟡scan_local_code(files)
Send selected editor file contents to the SimplyScan Security Engine's deterministic repository rules. Requires a Pro API key. Source leaves the editor, is processed in memory, and is not retained; masked findings are saved in the private scan record. No AI provider receives these files. Code rules analyse JavaScript and TypeScript; other files are checked for secrets only. When no file can be analysed, the result has no score.
Input Schema
{
"type": "object",
"properties": {
"files": {
"minItems": 1,
"maxItems": 50,
"type": "array",
"items": {
"type": "object",
"properties": {
"path": {
"type": "string",
"maxLength": 200
},
"content": {
"type": "string",
"maxLength": 200000
}
},
"required": [
"path",
"content"
]
}
}
},
"required": [
"files"
],
"$schema": "https://json-schema.org/draft/2020-12/schema",
"additionalProperties": false
}🟢check_security_headers(url)
Grade a URL's HTTP security headers (CSP, HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy, COOP, COEP) A-F.
Input Schema
{
"type": "object",
"properties": {
"url": {
"type": "string",
"format": "uri",
"description": "Full https URL to check"
}
},
"required": [
"url"
],
"$schema": "https://json-schema.org/draft/2020-12/schema",
"additionalProperties": false
}🟢check_ai_visibility(url)
AEO check: whether AI answer engines (ChatGPT/GPTBot, Claude, Perplexity, Google-Extended, etc.) can crawl and cite the site, plus llms.txt and structured-data signals.
Input Schema
{
"type": "object",
"properties": {
"url": {
"type": "string",
"format": "uri",
"description": "Full https URL to check"
}
},
"required": [
"url"
],
"$schema": "https://json-schema.org/draft/2020-12/schema",
"additionalProperties": false
}🟢check_seo(url)
On-page SEO audit of a URL: title, meta description, H1, canonical, indexability, Open Graph, structured data, image alt coverage, sitemap. Returns an A-F grade.
Input Schema
{
"type": "object",
"properties": {
"url": {
"type": "string",
"format": "uri",
"description": "Full https URL to check"
}
},
"required": [
"url"
],
"$schema": "https://json-schema.org/draft/2020-12/schema",
"additionalProperties": false
}🟢check_ssl(domain)
Inspect a domain's SSL/TLS certificate: issuer, expiry, protocol, and flags for expiring/self-signed/mismatched certs.
Input Schema
{
"type": "object",
"properties": {
"domain": {
"type": "string",
"minLength": 1,
"description": "Domain, e.g. example.com"
}
},
"required": [
"domain"
],
"$schema": "https://json-schema.org/draft/2020-12/schema",
"additionalProperties": false
}🟢check_email_security(domain)
Check a domain's email authentication: SPF, DKIM (common selectors), and DMARC policy. Flags spoofable domains.
Input Schema
{
"type": "object",
"properties": {
"domain": {
"type": "string",
"minLength": 1,
"description": "Domain, e.g. example.com"
}
},
"required": [
"domain"
],
"$schema": "https://json-schema.org/draft/2020-12/schema",
"additionalProperties": false
}🟢check_exposed_files(url)
Probe a site for accidentally exposed high-risk files (.env, .git/config, backups, etc.). Reports HTTP status only, never file contents.
Input Schema
{
"type": "object",
"properties": {
"url": {
"type": "string",
"format": "uri",
"description": "Full https URL to check"
}
},
"required": [
"url"
],
"$schema": "https://json-schema.org/draft/2020-12/schema",
"additionalProperties": false
}Community
Evidence