SecScan

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

• Connection: Runs in the cloud
• Transport: Streamable HTTP
• Category: Cybersecurity
• You need to fill in: Authorization

Install

Pick the AI app you use, then copy the settings.

You need

• Runs in the cloudNothing to install; it connects over the internet

Which app do you use?

claude mcp add --transport http secscan https://secscan.us/api/mcp --header 'Authorization: Bearer {token}'

{
  "mcpServers": {
    "secscan": {
      "url": "https://secscan.us/api/mcp",
      "headers": {
        "Authorization": "Bearer {token}"
      }
    }
  }
}

{
  "servers": {
    "secscan": {
      "type": "http",
      "url": "https://secscan.us/api/mcp",
      "headers": {
        "Authorization": "Bearer {token}"
      }
    }
  }
}

Your choice stays on this device in a cookie; no account needed.

Values you fill in

• Authorization secret required HTTP header
  A SecScan token (starts with ssk_). Create one at https://secscan.us/settings#ai-editors

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

Tool names and descriptions exactly as the server reported them on Nov 9, 2026. The maker wrote them, not us; we show them as plain text.

• scan_url

  Start a SecScan security scan of a web application the user owns or is authorised to test. Returns a scan_id; most scans finish in under a minute — then call get_scan_status with wait_seconds, or get_report. Active tests (injection, XSS, SSRF…) run only on domains the user has ve

• get_scan_status

  Status of a scan (queued, scanning, analyzing, complete, failed). With wait_seconds (max 60) it waits for the scan to finish and returns the full report as soon as it does.

• get_report

  The finished report for a scan: grade, what the scan tested and what it skipped (a clean grade says nothing about skipped areas, so say so), prioritised findings with fixes and evidence, and a fix prompt written for the user's AI editor. Findings come 25 per page, most severe fir

• list_recent_scans

  The user's most recent scans with their status, newest first.

• list_verified_domains

  Domains the user has proved they own. Only these receive active testing (injection, XSS, SSRF, access control); others get passive checks. Verify more at https://secscan.us/domains.

• get_account

  How many scans the user can still run — free scans, plan scans and credits — and their plan. Check this before starting several scans.

• start_domain_verification

  Begin proving the user owns a domain, which unlocks active tests (injection, XSS, SSRF, access control) on its scans. Returns a file to publish on the site, or a DNS TXT record — an editor can usually add the file to the codebase and deploy it. Then call check_domain_verification

• check_domain_verification

  Check whether the file or DNS record from start_domain_verification is live. On success the domain is verified and its next scan includes active tests. DNS changes can take a few minutes.

• list_monitors

  Sites under continuous monitoring: latest grade, last and next scan, uptime check, CVE alerts, new problems in the last scan and certificate expiry. Use the monitor id with monitor_scan_now.

• add_monitor

  Put a site the user owns under continuous monitoring: hourly uptime checks, CVE matching, certificate alerts and regular rescans. Runs a full baseline scan straight away, which uses one of the user's scans exactly as in the app (free for plan holders). Returns the baseline scan_i

• monitor_scan_now

  Run a full scan of a monitored site now instead of waiting for its schedule — e.g. to confirm a fix. Free for plan holders; otherwise uses one of the user's scans, as in the app. Takes the monitor id from list_monitors.

• dismiss_finding

  Mark a finding as a false positive for this site, so future scans of it stop reporting it — the same as Dismiss in the app, and undoable there. ONLY use this after the user has confirmed the finding is wrong; never dismiss a real problem to improve a grade.

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 9, 2026

• ! Caution

  Maker matches the repo

  The registry lists no source repo, so we cannot match the publisher (secscan.us) to the code

• … Not checked yet

  Still maintained

  We have not read this repo from GitHub yet

• … Not checked yet

  Has a licence

  We have not read this repo from GitHub yet

• ✓ Pass

  Endpoint responds

  Responded in 282 ms (HTTP 200)

• – Not applicable

  Sign-in with OAuth

  No sign-in needed

• ✓ Pass

  No hidden instructions in tool descriptions

  Read 12 tool descriptions and found no hidden instructions to the AI

Compared with others in Cybersecurityi

• More stars than 0% of the other 1003 servers in this category
• Published to the registry more recently than 48% of the other 1003 servers in this category
• Basic checks equal to or better than 33% of the other 1003 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:↓ Downloads per weeki★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

README from the maker

No README found in the repo